An exploration of the factors affecting the advertised price for stolen data

Abstract

A growing body of research has developed exploring the ways that data thieves dispose of information acquired through phishing, hacking, and mass data breaches. These studies suggest a range of products are sold in forums and IRC channels at a fraction of its true value. There is also substantial risk for participants as they may be cheated by vendors who may not deliver products or simply provide invalid data. These conditions have led researchers to question the nature of the market, in that the actual price for data is much higher than what is advertised based on the risk of repeatedly purchasing bad data. As a result, there may be multiple markets for data operating with different pricing based on the prevalence of unreliable vendors. In order to explore these issues, this study utilizes a sample of threads from 13 Russian and English language forums involved in the sale of stolen data to consider the influence of various social conditions on the advertised price for dumps and eBay and PayPal credentials. The findings suggest that prices are lower in markets where vendors may cheat customers, and higher in markets that appear more organized and legitimate. The implications of this study for future research are examined in depth.

Markets as Governance Environments for Organizations at the Edge of Illegality: Insights From Social Network Analysis

“…Thus, future research should consider both the embeddedness of individuals within the market, as well as market-level variables such as the type of good or service provided by a seller, product price and quality (Décary-Hétu & Leppänen, 2016;Holt et al, 2013Holt et al, , 2017. Similarly, there is a need to include other trust-creating mechanisms such as sample requests in statistical models to better understand the role of second-and third-party trust-creating mechanisms in online markets (see Herley & Florêncio, 2010;Holt et al, 2013). Such research can improve our understanding of the practices of illicit online actors relative to traditional economic models of market behavior.…”

Stolen account credentials: an empirical comparison of online dissemination on different platforms

“…Risk attributes coded specifically relating to platforms were measures aimed at anonymization and preventing rip-offs (Yip, Webber, and Shadbolt 2013). As for posts, to minimise distrust or suspicion, suppliers could state in their posts that they provide customer services, such as replacements for invalid credentials (Holt, Chua, and Smirnova 2013). If potential hijackers would receive invalid credentials, they would not risk having paid for credentials that do not work.…”

“…Coding risk attributes was, similar to coding additional information on accounts and account holders, largely a bottom-up process. While reading, we noted customer services such as customer service lines and free replacements (Holt, Chua, and Smirnova 2013). These services are aimed at improving customer satisfaction and could, therefore, affect the perceived risk of doing a transaction.…”

A Crime Script Analysis of the Online Stolen Data Market: Table 1

“…Advertised prices for stolen data may depend on the quantity of items to be purchased, the rarity of the items, the country of origin, the type of data, and further specifics (Holt et al , 2013, Holt & Lampke, 2010). The advertised price may not reflect the final price paid, as sellers offer discounts in order to attract customers and build trust within the market (Herley & Florêncio, 2010, Holt & Lampke, 2010.…”