Dark Web Price Index: What Your Stolen Data Sells For

Stolen personal data is cheap on the dark web: in the most recent Privacy Affairs index (2023), a single stolen card with its CVV averaged $10 to $15, a hacked Facebook or Instagram account about $25, and a scanned US passport around $50. The expensive items are the ones that are hard to fake or that unlock money directly: forged physical EU passports at $2,500 to $4,000, verified fintech and crypto accounts in the hundreds to low thousands, and access to corporate networks, which Rapid7 says averaged more than $113,000 per listing in 2025.

Prices for stolen data and crime services

All prices are in US dollars and are averages or ranges as published by each source. They are asking prices on listings, not confirmed sale prices.

Financial data and accounts

Online accounts, identity documents and bulk data

Hacking tools and attack services

Why most stolen data is so cheap

The main reason is oversupply. Recorded Future’s Insikt Group counted 269 million card records posted on dark and clear web platforms in 2024, and nearly all of it was card-not-present data meant for online fraud (Recorded Future, 2025). With that much supply, a single card is close to a commodity.

Infostealer malware adds to the glut. KELA observed more than 4.3 million infected machines in 2024, which together leaked over 330 million credentials (KELA, 2025). Sellers increasingly move this data in bulk or by subscription instead of one record at a time.

Privacy Affairs saw the same pattern from the other side. Most of the items it had tracked for three years became cheaper in 2023, even after police shut down several large markets in late 2022. Buyers also shifted toward bulk purchases rather than single documents.

Where prices go up

Three categories bucked the trend:

• Hard-to-fake physical documents: a forged EU passport still costs thousands because it requires physical production, not just a copy of data.
• Verified financial and crypto accounts: in the 2023 index, crypto exchange accounts were the only category that rose overall. A verified Kraken account went from $250 to $1,170.
• Corporate network access: Rapid7’s 2025 report on 2024 data found an average sale price just over $2,700, with nearly 40% of offers priced between $500 and $1,000 (Rapid7, 2025). Its follow-up on 2025 data put the average at $113,275. Rapid7 links the jump to brokers targeting larger companies and selling higher-privilege access, plus more listings on newer, pricier forums (Rapid7, 2026).

In each case, the price reflects how directly an item leads to money and how hard it is to replace. A card number can be canceled in minutes. Domain-admin access to a large company can lead to a ransomware payout.

How the market is changing

From big markets to Telegram and small shops

Police takedowns have changed how the market is built, but they have not shrunk the supply. After big markets were seized in 2022, Privacy Affairs saw operators launch smaller sites that run for a few months and then disappear. Telegram channels became a major sales venue. KELA notes that Genesis Market, a well-known shop for stolen browser data, was seized in April 2023, and that a successor called Exodus Market appeared in January 2024 with a paid subscription model.

Automation and subscriptions

Automated shops let buyers search stolen credentials by website or country and pay a fixed fee per entry. KELA gives $5 per entry as an example. Subscription “clouds of logs” deliver a steady feed of stolen data for a monthly fee.

Fragmentation

Europol’s 2026 assessment describes dark web markets as increasingly fragmented, with many platforms specializing in one type of crime (eucrim, 2026). Its 2025 report described data as a central commodity of the criminal economy, traded on specialized markets, forums and encrypted messaging channels (Europol, 2025).

Attack services now cost about as much as a streaming plan

Kaspersky analyzed more than 256,000 DDoS-related posts and identified 148 active DDoS actors. It found brokered attacks priced case by case at $30 to $2,000, and subscription attack tools starting at $1 (Kaspersky, 2026). Ready-made botnets start under $100 (Kaspersky, 2024).

Protecting your data

Cheap data is still a risk: criminals can buy it in bulk, so even small scams pay off. Focus on making stolen data useless:

• Assume your card number will leak at some point. Turn on transaction alerts, and use virtual or single-use card numbers for online shopping where your bank offers them.
• Make passwords worthless on their own. Use a unique password for every account (a password manager makes this easy), and turn on passkeys or app-based two-factor authentication, especially for email, banking and crypto accounts.
• Most of the credentials in bulk packs come from infostealer malware on personal devices. Avoid pirated software, cracked games and unknown browser extensions, and keep your operating system and browser updated.
• Avoid emailing passport scans or ID selfies unless you have to, and delete them from your cloud storage when you no longer need them. Sellers price these items because they are used to open accounts in other people’s names.
• After a breach notice, act quickly: change the affected password, check for unfamiliar logins and, in the US, consider a credit freeze with the three credit bureaus.

Methodology

Prices come only from published research by threat-intelligence firms and analysts (Privacy Affairs, Kaspersky, KELA, Rapid7, Recorded Future) and from Europol threat assessments. None come from visits to criminal marketplaces or purchases. All figures were published in US dollars, so none are converted.

Most figures are advertised prices or averages of listings; real transaction prices, discounts and scams between criminals are not visible. Each source samples different markets, forums and Telegram channels over different periods, so prices from different rows are not strictly comparable. The broadest consumer price list available is the Privacy Affairs 2023 edition, published in April 2023 and based on 2022 to early-2023 listings, and it is the most recent edition that could be accessed. Newer sources (KELA 2025, Kaspersky 2024 to 2026, Rapid7 2025 to 2026) cover narrower categories. Several sources are security companies that sell monitoring services, and their numbers are useful but not independently audited.

Figures that could not be traced to an original report are left out, including widely repeated 2025 and 2026 “price index” numbers on aggregator sites that do not show their sources.