Here’s what your stolen identity goes for on the Internet’s black market

The going rate for a stolen identity is about twenty bucks. Tens of millions of people have lost their private information in data breaches over the past few years. But what happens after that -- how the data are leveraged for financial gain -- remains murky. Many of those stolen records end up for sale on the anonymous, seedy area of the Internet commonly known as the dark web. Analyzing the sale of those records sheds some light on the vibrant market for stolen identities. On the dark web’s eBay-like marketplaces, the full set of someone’s personal information -- identification number, address, birthdate, etc. -- are known as “fullz.”

We analyzed listings for individual fullz that were put up for sale over the past year, using data collected by Grams, a search engine for the dark web. Our question: How much is a stolen identity worth? Among tens of thousands of records in the Grams data, we were able to identify more than 600 listings for individual identities -- some including credit card information, others without. The listings ranged in price from less than $1 to about $450, converted from bitcoin. The median price for someone’s identity was $21.35.