Following Your Stolen Data Through The Dark Web | Incognito Mode | WIRED

The digital underworld thrives on stolen information, a vast economy where personal data is bought, sold, and exploited. Hackers, from state-sponsored groups to common criminals, target individuals and corporations alike, compromising everything from financial details and medical records to social media logins. This data, once stolen, embarks on a journey through private hacker networks and dark web marketplaces, where it's packaged, auctioned, and traded for profit, often fueling further criminal activities like identity theft and fraud.

This illicit trade encompasses various forms of exploitation, including ransomware attacks that cripple organizations and extort payments, often with the threat of public data leaks. Beyond ransomware, the direct sale of compromised data is rampant, with elements like email addresses, passwords, and even sensitive personal information fetching prices on the underground market. This creates a continuous cycle of breaches and exploitation, making robust personal security measures crucial for safeguarding against ever-evolving cyber threats.

Hacked Data Economy Exposed

Investigating the lucrative, yet dangerous, world of stolen digital information and its subsequent trade.

• Individuals and companies are frequently targeted by hackers, leading to the theft of corporate secrets, credit card numbers, passwords, and medical information.
• There are different types of hackers, including state-sponsored, activists, and criminal hackers, each with distinct motivations and methods.
• Criminal hackers primarily make money through selling stolen data and ransomware attacks, with ransomware demands sometimes reaching 200 Bitcoin, approximately $22 million in one instance.
• Stolen data is traded on dark web marketplaces, where prices vary: credit card details for a $5,000 balance can cost $110, and a Netflix login may be as low as $10.
• Protective measures include using password managers for unique passwords, enabling multifactor authentication (avoiding SMS-based), freezing credit, and utilizing credit monitoring services.

Related Video Summary

• S. Korea dispatches joint response team to Cambodia amid rising scam crimes

Types of Hackers and Data Exploitation [00:26]

• Hackers can be categorized into state-sponsored groups (APTs), activists, and criminal hackers.
• State-sponsored hackers engage in espionage and blackmail for governmental purposes.
• Activists target organizations they disagree with, like weapons manufacturers or police departments.
• Criminal hackers are indiscriminate, stealing data to monetize it through various means.
• The fate of stolen data depends on the hacker type; state-sponsored breaches often result in data disappearing into a "black box."

The journey of stolen data varies significantly based on the perpetrator's intent, ranging from state-sponsored espionage to profit-driven criminal enterprises.

If it's a state sponsored hacker, we might not know what happens to that data because state sponsored hackers are acting on behalf of their own government.

The Hacked Data Economy and its Players [00:58]

• Data stolen from large breaches, like Equifax, may not surface publicly.
• Some data is leaked intentionally, as seen in Russia's hack of the Democratic National Committee, aimed at causing political chaos.
• Activists often share stolen data with journalists or post it themselves to embarrass or shame entities, such as the Anonymous group's actions against Russia.
• Criminal hackers steal large amounts of data, including credit card numbers, emails, passwords, and medical information, which is then sold and traded amongst other criminals.

Information exposed through criminal hacks is most likely to be seen online, and the original data thief may not be the one ultimately profiting from its misuse.

While any hacker might post information online, it's a criminal hack where you most likely see your information exposed.

Criminal Monetization of Stolen Data: Ransomware and Sales [02:55]

• Criminal hackers primarily make money through selling data and ransomware attacks.
• Ransomware encrypts a system, making it unusable, and demands payment, often threatening to leak sensitive data.
• Organizations, especially hospitals and government entities, are frequent targets of ransomware.
• Ransom demands can be substantial, with one instance involving 200 Bitcoin.
• Victims of ransomware face the choice of paying the ransom or dealing with the fallout of data leaks.
• Paying the ransom is discouraged by experts as it encourages more attacks.
• The case of Change Healthcare in 2024 illustrates a ransomware attack where a payment of 350 Bitcoin (around $22 million) did not prevent a second group from leaking the data.

Ransomware attacks pose a significant threat, holding critical systems hostage and risking the exposure of sensitive information, even after substantial payments are made.

Unfortunately for Change Healthcare, a second hacker group got its hands on the data and appeared to post it online.

The Underground Marketplace for Stolen Data [04:12]

• Stolen data is sold and traded, forming a massive underground economy known as the "hacked data pipeline."
• Newly stolen data first appears in private hacker networks, forums, and group chats before reaching the open market.
• This data is then moved to dark web marketplaces, accessible via specialized browsers like Tor, which protect user anonymity.
• Dark web marketplaces offer anonymity for both buyers and sellers, making them ideal for cybercriminals.

Stolen information flows through a complex network of underground channels, from private hacker groups to anonymous dark web marketplaces, facilitating its widespread illicit trade.

You can think of this as the wholesale distribution step where hackers share the data with trusted sources and try to unload it all at once for a huge sum.

Forum Dynamics and Sensitive Data [05:14]

• Hacker forums resemble regular online forums, with threads, comments, and reputation systems, all while participants try to remain anonymous.
• The most prevalent type of stolen data found in these breaches is email addresses, followed closely by passwords, which are often hashed.
• Other common attributes include names, phone numbers, and physical addresses.
• The most sensitive data includes government-issued IDs (passports, driver's licenses), health data, and deeply personal information, exemplified by the Ashley Madison breach.

The digital underground is a functional, albeit illicit, community where personal information is exchanged, ranging from common contact details to highly sensitive personal revelations.

By far the number one most prevalent is email address. Passwords are still enormously prevalent as well.

Dark Web Marketplaces and Data Valuation [06:20]

• Dozens of marketplaces exist for stolen data, including Sticks Market, Brian's Club, Russian Market, and Biden Cash.
• Some marketplaces list tens of thousands of items, often alongside illegal goods like drugs and counterfeit items.
• Prices for stolen data are surprisingly low; credit card details with a $5,000 balance can cost as little as $110, and a Netflix login may cost just $10.
• Credit card information is typically sold in bulk, while higher-value data like corporate secrets are often auctioned.
• Marketplaces are frequently controlled by groups from Eastern Europe or countries without extradition treaties with the US, such as Russia or China.
• Sales on these markets are predominantly conducted using cryptocurrency, making them harder to trace than traditional payment methods.

The dark web operates as a bazaar for illicit goods and services, with personal data being a commodity traded at remarkably low prices, often facilitated by untraceable cryptocurrencies.

Market prices for your data vary, but some are surprisingly cheap.

Exploitation of Stolen Data and Evolving Threats [07:13]

• Stolen data is used by cybercriminals for identity theft, account takeovers, medical fraud, and more.
• Credential stuffing, a common tactic, involves using stolen email/password combinations on various sites due to password reuse.
• Compromised email logins can grant access to social media, banking, and other sensitive accounts.
• Stolen information can be used for fraudulent bank account openings, loan applications, and tax fraud.
• Medical information can facilitate insurance scams or the illicit acquisition of prescription drugs.
• Data can be sold and resold multiple times, meaning the initial hacker may not be the one perpetrating the final fraud.
• Even basic information like name, email, and phone number can be used for phishing attacks or targeted scams.

The consequences of data breaches are far-reaching, enabling a cascade of fraudulent activities and scams that extend beyond the initial theft.

Once your information is posted online, it can be sold and resold and used by multiple hackers before you even know it's stolen.

Changes in Data Breach Landscape and Public Perception [08:32]

• Password protection methods have significantly improved since breaches in 2012 (e.g., LinkedIn, Dropbox), with more sophisticated hashing algorithms now in use.
• Attack vectors change as new platforms gain popularity or common vulnerabilities emerge, such as exposed MongoDB, Amazon S3 buckets, and elastic search instances.
• Despite these changes, millions of email addresses and personal information continue to appear in data breaches daily.
• Public understanding of cybersecurity is evolving, but a sense of "data breach fatigue" or apathy is developing among consumers.
• Tangible impacts like financial loss or significant privacy invasion are needed to spur action.
• Organizations are becoming more reticent about disclosing data breaches, often due to legal rights and fear of class-action lawsuits.

The cybersecurity landscape is in constant flux, with evolving attack methods and a growing sense of consumer apathy, while organizations increasingly minimize disclosures to avoid legal repercussions.

Consumers, if anything, I feel are developing a little bit of apathy where they're just like, h this another data breach.

Personal Security Measures Against Data Breaches [10:42]

• If notified of a breach, change your password immediately and do not reuse it.
• Utilize a password manager to create unique, strong passwords for all accounts.
• Even old data breaches pose a risk, as information can be used later for fraud.
• Freeze your credit if personal information that can be used for financial fraud is stolen.
• Employ credit monitoring services to detect fraudulent account openings.
• Enable multifactor authentication wherever available, using trusted tools like Google Authenticator or YubiKey, and avoid SMS-based authentication.
• Choose apps and websites from companies with a strong security track record to minimize the risk of data theft.

Proactive security measures, including strong password practices, multifactor authentication, and vigilant credit monitoring, are essential for mitigating the risks associated with inevitable data breaches.

The fact of the matter is, if your data hasn't already been stolen, it's probably going to happen at some point.