Exploring stolen data markets online: products and market forces

TLDR

The threat of hackers and data thieves has increased, yet few have examined how they dispose of the information obtained through computer attacks. This exploratory study aims to examine the market for stolen data. It does so by conducting a qualitative analysis of 300 threads from six web forums run by and for data thieves. The results show that personal and financial data can be obtained through these markets at a fraction of their true value, that distinct buyer‑seller relationships shape market structure, and that policy implications for law enforcement intervention are discussed.

Abstract

The threat of hackers and data thieves has increased, though few have considered the ways they dispose of the information obtained through computer attacks. This exploratory study examines the nature of the market for stolen data using a qualitative analysis of 300 threads from six web forums run by and for data thieves. The results suggest that all manner of personal and financial data can be obtained through these markets at a fraction of their true value. In addition, there are distinct relationships between buyers and sellers that shape the relationships and structure of these markets. Policy implications for law enforcement intervention are also discussed.