Data after the breach: Economics of the dark web

A breach is just the beginning. Once extracted, data moves through a sophisticated supply chain. Peek inside the dark web economy that turns stolen credentials into billions of dollars in profit.

Sean Michael Kerner

Published: 11 May 2026

When sensitive data is stolen in high-profile data breaches, the information doesn't simply vanish into a digital void. Data extraction is just the beginning of a calculated journey through a sophisticated criminal economy where files are tested, packaged, priced and listed on dark web marketplaces. There, buyers ranging from fraud rings to nation-state actors bid for access, after which the information is used to commit a host of cybercrimes.

The dark web is an encrypted layer of the internet intentionally hidden from casual browsers. Accessing the dark web requires anonymizing software, often using Tor, which routes traffic through encrypted multihop relays and resolves .onion addresses invisible to standard DNS. The commodities traded on the dark web include credentials, payment card data, personally identifiable information (PII), healthcare records, corporate network access, ransomware-as-a-service kits and forged documents.

With the FBI's Internet Crime Complaint Center reporting cybercrime losses exceeding $20.9 billion in 2025, a 26% increase over the previous year, it's clear that threat actors are exploiting a dynamic market that converts stolen data into reliable cash, making criminal investment in organized attacks highly lucrative.

The dark web is that market.

A professionalized supply chain: The players

The dark web operates with role specialization that mirrors a commercial supply chain.

The collectors. Phishing crews, infostealer operators and ransomware groups extract the raw data. Verizon's "2025 Data Breach Investigations Report" found that credential theft was present in 22% of breaches, 20% of exploited vulnerabilities and 16% of phishing activities. Flashpoint's "2025 Global Threat Intelligence Report" tracked more than 23 million hosts infected with infostealers, resulting in 2.1 billion harvested credentials.
Initial access brokers. IABs specialize in the intrusion phase, selling verified network access rather than executing attacks themselves.
Marketplace operators and aggregators. The platform layer includes BreachForums, Russian Market, 2easy and a growing number of Telegram channels. Operators collect listing fees while providing escrow systems, reputation scoring and dispute resolution. These markets often operate with commercial-grade controls.
The buyers. Fraud rings form the largest demand segment, acquiring PII, "fullz" -- complete identity packages -- and card data for account takeovers, synthetic identity fraud and fraudulent loan applications. Ransomware affiliates and nation-state actors buy IAB listings and proceed directly to encryption and exfiltration.

Dark web prices and payment

Pricing on dark web markets follows consistent logic, dictated by data freshness, completeness, validity and country tier.

DeepStrike's August 2025 dark web analysis, drawing on Trustwave, SOCRadar and live market data, found U.S. credit card data with CVV demand $10 to $40, while a card with a verified $5,000 balance fetches $110 to $120. Healthcare records can cost $500-plus per record and, unlike cards, they cannot be canceled or rotated. According to Check Point's 2025 IAB report, most corporate access listings price between $500 and $3,000, with domain admin credentials commanding far more.

Payments are almost always made with cryptocurrency. Bitcoin is common for ransomware transactions, while Monero is preferred for marketplace trades due to its built-in privacy features. Stablecoins, primarily USDT, account for 63% of illicit crypto volume according to Chainalysis's "2025 Crypto Crime Report."

Market scale and the data lifecycle

The dark web's stolen data market operates at measurable scale. KELA's "State of Cybercrime 2026" report tracked 2.86 billion compromised credentials circulating across criminal markets in 2025, spanning infostealer malware, breach databases and underground marketplaces.

Once extracted, stolen data moves through four distinct stages:

Aggregation. Credentials are tested against live services before listing, with verified pairs commanding higher prices.
Packaging. Material is assembled into combo lists, fullz bundles or stealer logs with one folder per infected machine containing browser passwords, cookies, autofill data and crypto wallet files.
Listing. The package is posted on a marketplace, often within hours of capture.
Distribution and reuse. Buyers purchase data; monetize it through fraud, account takeover or further intrusion; and often resell the information. Recaptured identity records circulate in criminal markets for years, generating losses for organizations long after the breach that produced it.

Law enforcement: Progress and limits

Prosecution for cybercrime remains the exception. Most operators work from jurisdictions with no extradition agreements with the U.S. or the EU. For example, LockBit leader Dmitry Khoroshev remains in Russia despite a $10 million U.S. State Department reward. BreachForums has been seized and reconstituted multiple times since 2023, with the most recent disruption in October 2025. While each takedown demonstrates what is possible, the reconstitutions demonstrate the limits.

Multi-agency operations have produced some promising results, however. For example:

Operation Cookie Monster. In April 2023, the FBI-led takedown of Genesis Market -- a dark web platform selling browser fingerprints, cookies and session data from 1.5 million compromised machines -- resulted in 119 arrests across 17 countries.
Operation Cronos. In February 2024, the National Crime Agency, FBI and Europol seized 34 LockBit servers, shut down the group's dark web leak site used for extortion, froze 200 cryptocurrency accounts and unmasked Khoroshev.
Operation RapTor. In 2025, the Europol-coordinated dark web crackdown targeted vendors across multiple dark web platforms, resulting in 270 arrests across 10 countries.

What CISOs need to do now

For security leaders, the dark web's underground economy changes monitoring priorities, risk thresholds and incident response assumptions. Security teams should consider taking the following actions to reduce risk.

Use the dark web for risk intelligence

Credentials surface in stealer-log data sets days before ransomware deploys. IAB listings target organizations by revenue range and sector, and ransomware leak sites name suppliers and customers alongside the primary victim. When monitored regularly, dark web intelligence can feed the security operations center with near-real-time criminal activity.

Bolster risk management

The dark web economy prices data based on freshness, completeness and usability. Data that cannot be quickly converted into access or fraud is less valuable on any marketplace. Three controls directly reduce that convertibility:

Enforcing phishing-resistant MFA across all remote access, cloud admin and SSO entry points.
Rotating credentials promptly on any stealer-log domain match.
Applying the principle of least privilege across all accounts.

Incident response

A breach does not end when ransomware is contained or a card number is reissued. Stolen records circulate and are resold, sometimes for years, fueling downstream attacks enabled by the original incident. Organizations that treat containment as closure are routinely wrong. Preserve forensic evidence early, engage law enforcement while the trail is fresh and share indicators through Information Sharing and Analysis Centers.

Sean Michael Kerner is an IT consultant, technology enthusiast and tinkerer. He has pulled Token Ring, configured NetWare and been known to compile his own Linux kernel. He consults with industry and media organizations on technology issues.

Next Steps

Enterprise dark web monitoring: Why it's worth the investment