Data is the oil of the digital economy. The commercial market for personal data is booming—large databases of subscriber information are increasing the value of companies that own it, though many have yet to turn a profit. As the commercial value of personal data grows, cybercriminals have built an underground economy selling stolen data to anybody with a computer browser and the means to pay.

In this report, we explain what happens with stolen data after a successful breach by detailing a few of the many ways in which cyber thieves monetize the information they have stolen. We also show, through many examples, what these marketplaces for stolen data look like and we document the value attached to certain types of stolen data.

We also highlight why apathy among victims of a data breach, and ultimately those data subjects whose information is being sold, may be costly. Finally, we explain why we as a society should be concerned when we receive notifications of breaches and why it is important to listen to advice for fighting cyberthreats.