By Josh Lebowitz
So you’ve got a solid email password. It’s unique to your email, not shared with any other sites (which is smart) and it’s pretty “ugly” and hard to guess, employing a variety of upper and lowercase letters, special characters and numbers. In other words, NOT “Password123.”
Congratulations, you’re doing everything right…for a change. Yet suddenly your friends and relatives start pinging you that you’ve been hacked. That “you’re” suddenly shilling for a Canadian pharmacy or hocking a dubious get-rich-quick scheme or pushing some random product that you’ve never heard about. Mind you, they’re a pretty clever group and aren’t falling for whatever it is “you’re” selling, but still, at the end of the day you’ve been hacked. Again.
In my case, what I notice about these bogus emails is that the language never seems quite seem right. There’s no oddly tangential rambling quality to the email, no obtuse humor references, no quirky nicknames for people, like I would usually pepper in there. Plus, “my” spelling and grammar – usually points of pride – are suddenly atrocious. Plus, I just don’t send such short emails with weird links.
Maybe it was a brute force attack, or some intercepted packets from a public wifi system, or an as-yet-unreported breach at my email provider. Hard to say how exactly this came about, but there it is. The proof is in the Canadian pharmacy, so to speak.
So I change my password, again, to something equally crunchy, and move on.
And then I start wondering what somebody got paid for my email address and password (and if they recouped their investment), and how and why my information is valuable; so, I do a little research and write a piece – this piece, in fact – about what our stolen data is worth, and how and where it gets sold.
The sad truth is that breaches are still happening. All the time. 60 million records here, 18 million records there, point of sale systems hacked here, a hotel chain or big box retailer breached for nearly a year there, Social Security numbers, payment card information accessed, stolen, compromised, etc. So where does it all go?
The answer, as many of you already know, is the Dark Web.
The Dark Web (a part of the Deep Web) is the highly encrypted, very-hard-to-track, nearly impossible-to-police, seamy underbelly of the ‘Surface Web’ (or “Clearweb”) that we all know and use every day. Initially envisioned as a place for dissidents from totalitarian countries to communicate without fear of being caught, the Dark Web has evolved into a free market on steroids where just about everything (and I mean everything) is for sale, for the right price, usually in bitcoin. There are reviews and seller ratings – in fact, upon casual perusal, it looks a lot like the Yelps, eBays, and Amazons of the surface web, until you see what’s being offered for sale, often at a bulk discount: counterfeit currencies, credit and debit card numbers, social security numbers, subscription TV accounts, faked and actual driver licenses, lots of drugs, weapons, explosives, full online identities, etc., etc.
And while it’s hard to put a number on ever-changing monetary values here, we’ve taken some averages from a number of recent studies and have created this aggregate. In general, buyers are willing to spend…
- $8 – $30 per U.S. credit card number depending on CVV, billing addresses, etc. and credit limit
- $20 per scan of actual driver license, up to $100 – $150 per counterfeit driver license
- $0.70 – $2.30 per email address
- $1 – $1.25 per Social Security numbers, though scans of counterfeit Social Security cards can fetch up to hundreds of dollars each
- $1 – $10 per Spotify/Hulu/Netflix/HBO GO/HBO NOW account
- $50 per healthcare record
- $400 – $700 per certain “.gov” accounts (due to the access they are afforded)
- $500 – $1000 per bank account or PayPal information (username, login, etc. depending on how much info is being offered and the amount of money in the account)
If that sounds like a lot of money being forked over, it is.
A study of Dark Web transactions – regarding batches of stolen data for sale – found the majority of these sales to be worth between $1 million and $2 million, when converted back from bitcoin. And not only are hackers and hacker groups making a lot of money from our pilfered information, they’re also costing the companies they breach untold millions of dollars in brand damage and remediation. In fact, according to the most recent IBM/Ponemon report, the average cost to a company is now just over $150 per stolen record. Retailers were shelling out about $160, while Healthcare organizations paid the most – an average of just over $360 per stolen or compromised health record.
So what we have is a lose-lose proposition (unless you’re a hacker): a very lucrative black market feeding off of our data, costing us time, trouble and occasionally credit scores, and costing our banks, credit card issuers, retailers, hotel chains and healthcare providers billions of dollars each year. Data theft is, clearly, not a victimless crime as legitimate businesses take a beating due to lost revenue, brand damage and remediation fees, often needing to pass their losses on to their customers in extra fees and charges.
