Supply chain research finds dark web marketplace generates hundreds of millions of dollars from the sale of stolen personal data

Almost every year, we all hear about various major data breaches, where user information is stolen or important systems are hacked and large amounts of user data are stolen. But what happens when your personal data is stolen? Research has shown that stolen data, like any product, has a supply chain that includes the manufacturer, the wholesaler, and the consumer. This supply chain has been revealed to connect many criminal organizations operating in the illegal underground dark web marketplace.

The supply chain in the dark web marketplace

According to the study, the supply chain begins with "producers" who use vulnerable systems to steal sensitive information, such as credit card numbers, bank account information, and social security numbers. This data is then listed in the form of advertisements by "wholesalers and distributors". Finally, the stolen data is purchased by "consumers" to commit a variety of fraudulent activities, including fraudulent credit card transactions, identity theft, and phishing attacks.

This exchange of stolen data between producers, wholesalers, and consumers is facilitated by dark web marketplaces, which are websites similar to regular e-commerce sites but can only be accessed through a special browser or authorization code.

As described in a research paper published in The Conversation, there are thousands of vendors selling tens of thousands of pieces of stolen data from 30 dark web marketplaces. Together, these sellers generated more than $140 million in revenue during the eight-month study period.

Just like e-commerce sites

Like traditional e-commerce sites, dark web marketplaces provide a platform for sellers to connect with potential buyers to facilitate transactions. However, dark web marketplaces are notorious for selling illegal products. Another important difference is that access to dark web marketplaces is done through the use of proprietary software, such as The Onion Router or TOR Browser, which provides security and anonymity.

Silk Road, which emerged in 2011 by combining TOR and Bitcoin, became the first known dark web marketplace, and in 2013 its founder Ross Ulbricht was caught and sentenced to a total of 140 years (2 life sentences plus 40 years in prison) in prison. However, these heavy penalties do not seem to have had the desired deterrent effect and only left a gap in the dark web that needed to be filled, with Silk Road soon being replaced by a number of different markets. The turnover of Silk Road also set the stage for a competitive, profit-driven ecosystem.

US$140 million in revenue

During the eight-month survey, experts observed 96,672 product listings and 2,158 sellers in 30 dark web marketplaces. These sellers and marketplace owners were observed to have made a total of 632,207 transactions during the relevant period, generating a total revenue of US$140,337,999. Again, there was considerable variation between the various dark web marketplaces. On average, marketplaces made 26,342 sales and generated US$5,847,417 in revenue.

The three largest marketplaces on the dark web are Apollon, WhiteHouse, and Agartha. the most successful of these is Agartha with sales of approximately $91 million and the Cartel marketplace with sales of approximately $32.3 million.

In the US, a medium-sized company has annual revenues of between US$10 million and US$1 billion. Therefore, most dark web marketplaces can actually generate revenues the size of a mid-sized company. Expert research detailing the thriving underground economy and illicit supply chains enabled by dark web marketplaces has shown that where there is stolen data, there will be a market with or without the dark web. The solution in this area is believed to lie in advances in cyber security and artificial intelligence, providing law enforcement and financial institutions with the information necessary to prevent stolen data from being used for fraudulent purposes.

The market for Stolen Data on the Dark Web

The following tables provide key statistics on the individual dark web-stolen data markets.