10 ms·

> The seller told Motherboard that 100 million people had their data compromised in the breach. In the forum post, they were offering data on 30 million people

> The seller told Motherboard that 100 million people had their data compromised in the breach. In the forum post, they were offering data on 30 million people for 6 bitcoin, or around $270,000. Is it possible that one day the market for SSNs and other private data will become so saturated that exfiltrating such data becomes unprofitable? On a slightly more serious note, is anyone aware of a compilation of prices paid for such data? I'm imagining something like a Consumer Price Index [1], but for stolen private data. Maybe far in the dystopian future inflation will make life harder for hackers. [1] https://www.bls.gov/cpi/ https://www.bls.gov/cpi/

onion2k 5y ago
Is it possible that one day the market for SSNs and other private data will become so saturated that exfiltrating such data becomes unprofitable? The revenue isn't 6 BTC. It's 6 BTC * however many people are willing to buy at that price. More suppliers would surely drive the price down, but at this point there are probably tens of thousands of people who'd buy if the data was cheaper, so it'll remain profitable for a long time.
- trimbo 5y ago
  If there's a large enough market, why doesn't someone buy it and then undercut the original seller by selling it for 3 BTC? Or 1? (Or maybe they do?)
  - bbarnett 5y ago
    There will be a licensing agreement, of course. (Napoleon Dynamite 'Gawd!')
  - vngzs 5y ago
    The price goes down as a target is in more breaches. If your SSN is previously leaked, it's worth less.
  - deleted 5y ago
    [deleted]
- paulddraper 5y ago
  True. Increased supply offset by increased demand.
martinald 5y ago
That's one way of looking at it, the other is that the financial system itself begins to fail under the volume and price of fraud. Ransomware ransoms have increased massively. They were often a few thousand dollars only a few years ago, now often hear about $50m+. On the smaller scale SMS/email phishing has got absolutely enormous too in volumes. Banks and credit card providers are refunding 100s of millions (if not more) in fraud, in actually a very low margin business (retail banking). It genuinely could threaten the ability of banks to continue operating retail banking services if it continues to almost exponentially grow.
- nerdponx 5y ago
  Good! Maybe then the government will actually start to care once the lobbyists start to ask for help. The downside is that the "help" will probably just consist of funneling more taxpayer money to large shareholders and execs, while banks figure out ways to dodge liability without actually solving the problem.
  - vosper 5y ago
    Is the government required here [0]? Could commercial operators not improve their own security through their own investment and taking it seriously? If ransomware hits them in the chequebook where stolen customer data didn't, then they might find that quite motivating? [0] It obviously is for government departments.
    - tialaramex 5y ago
      The government is the final arbiter in a bunch of cases you care about. Whether you are (for example) a US citizen is not a decision for T-Mobile, or Amazon, or Walmart, or Delta, that's up to the US government† The government (and not private corporations) tracks births, deaths, immigration, emigration, and of course it chooses to issue identity paperwork. In general the closest commercial entities like banks can do is identity matching. So e.g. maybe Bank A asks you "Hey, do you have, like, a mortgage? Who with?" and you pick Bank X from the list of six options and OK, either that's a lucky guess or you know that "you" have a mortgage with Bank X. This is pretty poor, it's something, but it's not very much, it's up there with Facebook's "Here are some pictures of people, which of them is your friend?" which of course falls down when either: You "friend" people you don't actually know and wouldn't recognise; or your "friends" don't like Facebook having accurate photo data and intentionally mislabel random other people or things with their name... And as with the Facebook thing it breaks in surprising and hard to reproduce/ demonstrate ways. Maybe you think of this as your Big Bank mortgage, but if you check the small print it's actually a Different Bank mortgage, that Big Bank are re-branding, and so you just picked wrong. So yes, in practice government is where this would get solved, if you've any appetite for solving it.
vngzs 5y ago
From Flashpoint's analysis [0], in 2019 a SSN is $5. [0]: https://go.flashpoint-intel.com/docs/pricing-analysis-of-goods-in-cybercrime-communities https://go.flashpoint-intel.com/docs/pricing-analysis-of-goo...
- criticaltinker 5y ago
  Very informative, thanks for sharing. Here are a couple excerpts I found interesting: > FULLZ: Slang for a full package of personal information connected to an individual, fullz provide enough information for a criminal to steal and profit from a victim’s identity. Fullz generally include the victim’s name, Social Security number, date of birth, account numbers, and more. > REPRESENTATIVE SAMPLE OF 2019 FULLZ PRICING IN USD > 2018 credit card and fullz from service industry $10 > Cashing out bank accounts and fullz empty it $4 > EU/Asia/UK credit cards / fullz $860 > $20,000 bank loan cashout using fullz $30 > Fullz SSN - DoB $5 > REPRESENTATIVE SAMPLE OF 2019 IDENTIFICATION DOCUMENTS AND PRICES IN USD > U.S. passport PSD template $18 > Driver’s license template, passport, certificates $1,000 > UK driving license, passport pack, PSD photo $3-$26 > Australian passport PSD template $18 > Canadian passport PSD template $26-$46 > France passport PSD template $45 > Germany passport PSD template $46 > Netherlands passport PSD template $50 > Spain passport PSD template $45 > Sweden passport PSD template $5 > Turkey passport PSD template (fully editable) $45
  - vmception 5y ago
    Yeah a less liability inducing and common thing to do is that you can use these to make accounts at exchanges and private equity that exclude people from your country Usually US and China and the OFAC list are excluded due to differing regulations Nobody knows or cares. The financial institution, the capital raiser, the person with their ID used You’re just trying to get into some presales or trade derivatives and that doesnt have criminal liability
Overton-Window 5y ago
Not your keys, not your data. These compromises only strengthen the argument for decentralisation and pseudonyms.
fingerlocks 5y ago
T-mobile has roughly 105 million subscribers, as per cursory Google search. So that’s everyone?
whoomp12342 5y ago
no, because people who get compromised will eventually put in place anti-fraud measures, effectively making stale data have a halflife and at the same time creating new targets
throwawayboise 5y ago
I can't imagine that it already isn't. SSNs were never secret until fairly recently. I guess an up-to-date cross-reference of SSNs and current active accounts of other types might always have some value to certain buyers.
73r7fudhdjduru 5y ago
Considering almost 1/3 illegal immigrants use stolen identity information and the Democrats aren't eager to fix the border, since children of illegal immigrants slant blue, this seems unlikely barring another situation where the Republicans control the House, Senate, and Presidency (and don't screw the time away arguing amongst themselves).
twistiti 5y ago
You can get an rough idea using https://www.privacyaffairs.com/dark-web-price-index-2021/ https://www.privacyaffairs.com/dark-web-price-index-2021/ report A valid US valid social security number is estimated at 2$, a USA selfie with holding ID is estimated at $100 $2
- SkyMarshal 5y ago
  Note to self, never take a selfie while holding my ID, negotiate some other means of remote identity verification.
  - contravariant 5y ago
    That seems like good advice in general. Not to mention that it's somewhat pointless as a method of verification in the first place since you can't exactly check the validity of an ID in a grainy selfie.
  - prirun 5y ago
    Tell that to Carvana. This is their method of identification when they deliver a car. I told them I would just show the driver my license when he got here. Nope, they wouldn't do that. Terrible company IMO. I ended up not doing a transaction with them and they wouldn't delete my data from their systems. Companies are just asking to be hacked when the store all this unnecessary data for people who are not even their customers.
- criticaltinker 5y ago
  Thanks for sharing the link, that is very close to what I was looking for - even a bit more comprehensive than I expected.
8ytecoder 5y ago
If all the leaks accumulate we’ll just have one giant global lookup table with SSNs, names and addresses.
vmception 5y ago
Not really. The prices of leaked data are already at rock bottom. People can do very lucrative things with your identity that dont cause any liability to you. This may be more common than the horror stories, and there is no way to collect the data. Think about it, someone shut out of the credit system uses your identity and gets a credit card and helps improve your credit score. Many people might see the unfamiliar line and just not bother, many people would never notice. Think about things which wouldn't get reported: you would never know if someone had opened another checking account in your name, right now. What about doing ID verification at an exchange merely to pass know-your-customer and anti-money laundering requirements to get greater withdrawals? Innocuous, as all account holders have to do that. Yeah some people are probably getting framed. Its more likely that this gets investigated properly and shocks everyone into repealing some money-stigmatizing laws since the wrong people are getting indicted.
xtiansimon 5y ago
> “ Is it possible that one day the market for SSNs and other private data will become so saturated that exfiltrating such data becomes unprofitable?” Not before the bevy of PII data points can be integrated into larger and larger datasets describing _individuals_. Right now if you breach one database, you have one ‘snapshot’ of the elephant. Add more and more data, and soon you can make connections between private and public information. What then? You could model a lot of information. What street were you born on? First school? Early childhood friend? Sound familiar?

onion2k 5y ago

Is it possible that one day the market for SSNs and other private data will become so saturated that exfiltrating such data becomes unprofitable? The revenue isn't 6 BTC. It's 6 BTC * however many people are willing to buy at that price. More suppliers would surely drive the price down, but at this point there are probably tens of thousands of people who'd buy if the data was cheaper, so it'll remain profitable for a long time.

trimbo 5y ago
If there's a large enough market, why doesn't someone buy it and then undercut the original seller by selling it for 3 BTC? Or 1? (Or maybe they do?)
- bbarnett 5y ago
  There will be a licensing agreement, of course. (Napoleon Dynamite 'Gawd!')
- vngzs 5y ago
  The price goes down as a target is in more breaches. If your SSN is previously leaked, it's worth less.
- deleted 5y ago
  [deleted]
paulddraper 5y ago
True. Increased supply offset by increased demand.

martinald 5y ago

That's one way of looking at it, the other is that the financial system itself begins to fail under the volume and price of fraud. Ransomware ransoms have increased massively. They were often a few thousand dollars only a few years ago, now often hear about $50m+. On the smaller scale SMS/email phishing has got absolutely enormous too in volumes. Banks and credit card providers are refunding 100s of millions (if not more) in fraud, in actually a very low margin business (retail banking). It genuinely could threaten the ability of banks to continue operating retail banking services if it continues to almost exponentially grow.

nerdponx 5y ago
Good! Maybe then the government will actually start to care once the lobbyists start to ask for help. The downside is that the "help" will probably just consist of funneling more taxpayer money to large shareholders and execs, while banks figure out ways to dodge liability without actually solving the problem.
- vosper 5y ago
  Is the government required here [0]? Could commercial operators not improve their own security through their own investment and taking it seriously? If ransomware hits them in the chequebook where stolen customer data didn't, then they might find that quite motivating? [0] It obviously is for government departments.
  - tialaramex 5y ago
    The government is the final arbiter in a bunch of cases you care about. Whether you are (for example) a US citizen is not a decision for T-Mobile, or Amazon, or Walmart, or Delta, that's up to the US government† The government (and not private corporations) tracks births, deaths, immigration, emigration, and of course it chooses to issue identity paperwork. In general the closest commercial entities like banks can do is identity matching. So e.g. maybe Bank A asks you "Hey, do you have, like, a mortgage? Who with?" and you pick Bank X from the list of six options and OK, either that's a lucky guess or you know that "you" have a mortgage with Bank X. This is pretty poor, it's something, but it's not very much, it's up there with Facebook's "Here are some pictures of people, which of them is your friend?" which of course falls down when either: You "friend" people you don't actually know and wouldn't recognise; or your "friends" don't like Facebook having accurate photo data and intentionally mislabel random other people or things with their name... And as with the Facebook thing it breaks in surprising and hard to reproduce/ demonstrate ways. Maybe you think of this as your Big Bank mortgage, but if you check the small print it's actually a Different Bank mortgage, that Big Bank are re-branding, and so you just picked wrong. So yes, in practice government is where this would get solved, if you've any appetite for solving it.

vngzs 5y ago

From Flashpoint's analysis [0], in 2019 a SSN is $5. [0]: https://go.flashpoint-intel.com/docs/pricing-analysis-of-goods-in-cybercrime-communities https://go.flashpoint-intel.com/docs/pricing-analysis-of-goo...

criticaltinker 5y ago
Very informative, thanks for sharing. Here are a couple excerpts I found interesting: > FULLZ: Slang for a full package of personal information connected to an individual, fullz provide enough information for a criminal to steal and profit from a victim’s identity. Fullz generally include the victim’s name, Social Security number, date of birth, account numbers, and more. > REPRESENTATIVE SAMPLE OF 2019 FULLZ PRICING IN USD > 2018 credit card and fullz from service industry $10 > Cashing out bank accounts and fullz empty it $4 > EU/Asia/UK credit cards / fullz $860 > $20,000 bank loan cashout using fullz $30 > Fullz SSN - DoB $5 > REPRESENTATIVE SAMPLE OF 2019 IDENTIFICATION DOCUMENTS AND PRICES IN USD > U.S. passport PSD template $18 > Driver’s license template, passport, certificates $1,000 > UK driving license, passport pack, PSD photo $3-$26 > Australian passport PSD template $18 > Canadian passport PSD template $26-$46 > France passport PSD template $45 > Germany passport PSD template $46 > Netherlands passport PSD template $50 > Spain passport PSD template $45 > Sweden passport PSD template $5 > Turkey passport PSD template (fully editable) $45
- vmception 5y ago
  Yeah a less liability inducing and common thing to do is that you can use these to make accounts at exchanges and private equity that exclude people from your country Usually US and China and the OFAC list are excluded due to differing regulations Nobody knows or cares. The financial institution, the capital raiser, the person with their ID used You’re just trying to get into some presales or trade derivatives and that doesnt have criminal liability

Overton-Window 5y ago

Not your keys, not your data. These compromises only strengthen the argument for decentralisation and pseudonyms.

fingerlocks 5y ago

T-mobile has roughly 105 million subscribers, as per cursory Google search. So that’s everyone?

whoomp12342 5y ago

no, because people who get compromised will eventually put in place anti-fraud measures, effectively making stale data have a halflife and at the same time creating new targets

throwawayboise 5y ago

I can't imagine that it already isn't. SSNs were never secret until fairly recently. I guess an up-to-date cross-reference of SSNs and current active accounts of other types might always have some value to certain buyers.

73r7fudhdjduru 5y ago

Considering almost 1/3 illegal immigrants use stolen identity information and the Democrats aren't eager to fix the border, since children of illegal immigrants slant blue, this seems unlikely barring another situation where the Republicans control the House, Senate, and Presidency (and don't screw the time away arguing amongst themselves).

twistiti 5y ago

You can get an rough idea using https://www.privacyaffairs.com/dark-web-price-index-2021/ https://www.privacyaffairs.com/dark-web-price-index-2021/ report A valid US valid social security number is estimated at 2$, a USA selfie with holding ID is estimated at $100 $2

SkyMarshal 5y ago
Note to self, never take a selfie while holding my ID, negotiate some other means of remote identity verification.
- contravariant 5y ago
  That seems like good advice in general. Not to mention that it's somewhat pointless as a method of verification in the first place since you can't exactly check the validity of an ID in a grainy selfie.
- prirun 5y ago
  Tell that to Carvana. This is their method of identification when they deliver a car. I told them I would just show the driver my license when he got here. Nope, they wouldn't do that. Terrible company IMO. I ended up not doing a transaction with them and they wouldn't delete my data from their systems. Companies are just asking to be hacked when the store all this unnecessary data for people who are not even their customers.
criticaltinker 5y ago
Thanks for sharing the link, that is very close to what I was looking for - even a bit more comprehensive than I expected.

8ytecoder 5y ago

If all the leaks accumulate we’ll just have one giant global lookup table with SSNs, names and addresses.

vmception 5y ago

Not really. The prices of leaked data are already at rock bottom. People can do very lucrative things with your identity that dont cause any liability to you. This may be more common than the horror stories, and there is no way to collect the data. Think about it, someone shut out of the credit system uses your identity and gets a credit card and helps improve your credit score. Many people might see the unfamiliar line and just not bother, many people would never notice. Think about things which wouldn't get reported: you would never know if someone had opened another checking account in your name, right now. What about doing ID verification at an exchange merely to pass know-your-customer and anti-money laundering requirements to get greater withdrawals? Innocuous, as all account holders have to do that. Yeah some people are probably getting framed. Its more likely that this gets investigated properly and shocks everyone into repealing some money-stigmatizing laws since the wrong people are getting indicted.

xtiansimon 5y ago

> “ Is it possible that one day the market for SSNs and other private data will become so saturated that exfiltrating such data becomes unprofitable?” Not before the bevy of PII data points can be integrated into larger and larger datasets describing _individuals_. Right now if you breach one database, you have one ‘snapshot’ of the elephant. Add more and more data, and soon you can make connections between private and public information. What then? You could model a lot of information. What street were you born on? First school? Early childhood friend? Sound familiar?