A Depiction and Classification of the Stolen Data Market Ecosystem and Comprising Darknet Markets: A Multidisciplinary Approach

Abstract

Scant research has investigated the illicit online ecosystem that enables the sale of stolen data. Even fewer studies have examined the longitudinal trends of the markets on which these data are bought and sold. To fill this gap in the literature, our research team identified 30 darknet markets advertising stolen data products from September 1, 2020, through April 30, 2021. We then developed python web scrapers to systematically extract information pertaining to stolen data products on a weekly basis. Using these data, we calculated the number of vendors, listings, sales, and revenue across the markets and at the aggregate, ecosystem level. Moreover, we developed a data-driven market classification system drawing from ecological principles and dominant firm theory. Findings indicate that markets vary in size and success. Although some markets generated over $91 million in revenue from stolen data products, the median revenue across markets during the observational period was only $95,509. Variability also exists across markets in respect to the number of vendors, listings, and sales. Only three markets were classified as financially successful and stable (i.e., dominant firms). We argue resources should be allocated to target markets fitting these criteria.

Understanding markers of trust within the online stolen data market: An examination of vendors’ signaling behaviors relative to product price point

“…Global data breaches affecting both corporations and individual consumers have surged considerably during the past two decades, generating an increasingly competitive and saturated stolen data marketplace that offer prospective customers a wide assortment of products (Howell et al., 2023; Huang & Ban, 2019). Although studies exploring stolen data markets have increased, few have examined vendors’ signaling practices in relation to product price point.…”

“…Another limitation of the current study is that these products and behaviors may no longer reflect the current state of the stolen data marketplace, as the sample was limited to data collected between 2018 and 2019 (see Howell et al. [2023] for more recent sample). Although the current sample provides a recent illustration of the stolen data marketplace, the findings can only function as a snapshot of the product listing and pricing structure of this time.…”

Collective Displacement of Regional Cryptomarket Vendors—A Study on the Aftermath of the Flugsvamp 3.0 Closure

“…The spikes are also notable in an international perspective. In a recent study of 30 cryptomarkets, most averaged around four new vendors per day, and only two averaged more than 10 new vendors per day (Howell et al, 2023).…”

Decoding hidden darknet networks: What we learned about the illicit fentanyl trade on AlphaBay

“…Since the takedown of the Silk Road, which brought worldwide attention to the darknet, research on DNMs has grown. Studies have examined single DNMs (e.g., Silk Road [38,39], Evolution [40], Dream [41], and the first iteration of AlphaBay [42]) and/or multiple DNMs [43,44]. DNM studies used quantitative and qualitative research methods examining vendor characteristics [38,39,45], market structure [46], the variety, volume, and pricing of illicit goods and services [47], and comments and ratings (or feedback) on vendors and/or products [48].…”

“…Dream [41], and the first iteration of AlphaBay [42]) and/or multiple DNMs [43,44]. DNM studies used quantitative and qualitative research methods examining vendor characteristics [38,39,45], market structure [46], the variety, volume, and pricing of illicit goods and services [47], and comments and ratings (or feedback) on vendors and/or products [48].…”