What Kind of Information Is Sold on the Dark Web?

The dark web isn’t just a shadowy corner of the internet, it’s an active economy where stolen, forged, and illicit data is regularly bought and sold. From basic personally identifiable information (PII) like names and social security numbers to high-value corporate access credentials, the underground market offers a diverse portfolio of digital goods.

In 2024, threat intelligence experts noted a sharp rise in listings for RedLine stealer logs, Fullz, and initial access credentials to corporate systems, some being sold for as little as $10, others exceeding $4,000 depending on the target’s value. (ThreatIntelligenceLab, 2024, Kaspersky, 2023)

But what information is being sold on dark web, and why does it matter?

This article breaks down the types of information sold on the dark web, how much it’s worth, and what industries and individuals are most at risk, using a semantic and entity-driven approach that separates myths from measurable threat intelligence.

1. Personally Identifiable Information (PII)

Personally Identifiable Information (PII), especially when sold as “Fullz” is one of the most in-demand data categories on the dark web. In cybercriminal terms, Fullz refers to a complete digital identity profile, offering everything needed to impersonate an individual or commit large-scale fraud.

What’s Typically Included in Fullz:

• Full legal name
• Social Security Number (SSN)
• Date of birth
• Driver’s license or passport number
• Residential address and phone number
• Employment details and credit report data
• Email address and sometimes password hash

This level of detail allows criminals to bypass basic identity verification systems, apply for loans or credit cards, hijack financial accounts, or socially engineer their way into corporate systems.

Fullz are often sold for $10 to $100 each, with pricing based on data freshness, geographic relevance (e.g., U.S. or EU-based), and whether financial or medical data is included. When bundled with bank credentials, card dumps, or device fingerprints, their value multiplies.

• Read: How to check if your email is on the dark web

2. Financial Information and Carding Data

One of the most active categories on the dark web is financial data. Cybercriminals frequently sell stolen credit card details, debit card dumps, bank login credentials, and PayPal accounts.

This category typically includes:

• Credit and debit card numbers (with or without CVV)
• Cardholder name and billing address
• Bank login credentials
• Online wallet access (PayPal, Venmo, Cash App)
• Cryptocurrency wallet seed phrases or private keys

Stolen card data can be sold for as low as $5 for basic information, while full card dumps with track 1 and track 2 data, PINs, and billing info may range from $25 to $200 depending on the issuing bank and card limit.

Carding forums also offer pre-made fake bank statements and synthetic identities for money laundering and fraudulent account creation. Some vendors sell “fresh” dumps, meaning recently acquired cards with high usability rates.

3. Stolen Login Credentials

Credentials to online platforms, corporate systems, and personal accounts are constantly being dumped and traded on the dark web. These include everything from social media logins to enterprise-level VPN credentials.

Commonly sold credentials include:

• Email logins (Gmail, Yahoo, Outlook)
• Social media accounts (Facebook, Instagram, LinkedIn)
• Streaming services (Netflix, Spotify, Disney+)
• Corporate emails and admin panels
• VPN and RDP access to business networks
• Developer platforms (GitHub, AWS, cPanel)

Credentials stolen via malware like RedLine stealer and info stealers are often sold in logs, bundled by country, domain, or platform. These logs can include browser-stored passwords, cookies, and even autofill data like names and addresses.

According to Kaspersky, access to a single corporate RDP environment was being sold for $2,000 to $4,000 depending on the privilege level and company size.

4. Medical Records and Health Data

Stolen medical records are among the highest-value assets on the dark web—not because of instant resale value like credit cards, but due to their depth, permanence, and exploitability.

These datasets often include:

• Full name, date of birth, address
• Insurance ID numbers
• Diagnosis codes and treatment history
• Prescription records
• Hospital, physician, and insurance provider information

Unlike credit cards that can be frozen or replaced, medical records are immutable—making them ideal for long-term identity theft, insurance fraud, and even blackmail campaigns targeting public figures or corporate executives.

In 2023, a healthcare-specific ransomware group leaked over 1.3 million patient records, which were later repackaged and sold on hidden marketplaces. Buyers ranged from identity thieves to nation-state intelligence agents looking for leverage on foreign targets.
Corporate Network Access and Initial Entry Points

Corporate access is the golden goose of the cyber underground. Instead of stealing individual data points, attackers buy or sell access to entire business infrastructures—opening the door for ransomware deployment, data exfiltration, or espionage.

Dark web marketplaces offer:

• Admin-level VPN or RDP credentials
• Webmail access for C-level executives
• Compromised firewalls or network gateways
• Panel access for CMS, ERP, or HR systems
• Domain controller/Active Directory credentials

According to a Kaspersky report, cybercriminals are now acting as Initial Access Brokers (IABs), selling enterprise entry points for as little as $2,000, often based on company size and sector.

In many ransomware cases, forensic analysis has shown that initial access was purchased, not acquired through phishing. These brokers work closely with ransomware-as-a-service (RaaS) groups and often use RedLine or Vidar logs to identify entry points.

• Read: How to Access the Dark Web on iPhone

6. Government, Military & Political Data

Highly sensitive and often geopolitically valuable, government and military data leaks are traded in closed forums and invite-only darknet enclaves, not public marketplaces. These records may include:

• Passport scans and immigration records
• Intelligence briefings and operational maps
• Police personnel data and internal comms
• Voter databases and election infrastructure access
• Leaked surveillance data or intercepted communications

Unlike traditional stolen data, this category is often sold not for money but for political leverage, cyberwarfare strategies, or ideological alignment. State-backed hacking groups may engage in both buying and selling.

“A 2022 leak exposed over 190,000 scanned IDs from a Southeast Asian government portal, including access logs, credentials, and internal notes.”
— Source: Recorded Future Threat Research

This information is used for:

• Creating synthetic passports and citizenship
• Targeting officials in phishing/extortion campaigns
• Influencing public opinion or elections through leaked comms
• Planning cross-border cyber operations

7. Malware, Exploit Kits & Zero-Day Vulnerabilities

On the dark web, malware is not just software — it’s a commodity. It’s packaged, versioned, supported, and even marketed. Threat actors don’t always write code; they purchase exploit kits and malware payloads as turnkey solutions to launch sophisticated cyberattacks. This “malware-as-a-service” economy thrives in highly structured darknet marketplaces, with full documentation, reviews, and even bundled support.

Categories of Malware Sold:

Malware Type	Description	Price Range
Infostealers	Steal browser-stored credentials, cookies, and autofill data	$50–$200/license
RATs (Remote Access Trojans)	Full device control; webcam, keystrokes, persistence	$100–$500
Keyloggers	Capture keystrokes & clipboard	$25–$100
Crypters	Encrypt payloads to evade AV/EDR	$50/month
Ransomware Toolkits	Full RaaS platform with dashboard	% share or $500+ entry
Botnets	Distributed infrastructure for spam or DDoS	$200+ for access

Zero-Day Exploit Market

Zero-day vulnerabilities are unpatched, unknown flaws in software that can be weaponized immediately. Unlike commodity malware, they are sold in closed forums or through private brokers due to their extreme sensitivity.

According to Recorded Future, zero-days for remote code execution (RCE) in Microsoft Exchange, Fortinet, or Cisco ASA systems can command $30,000–$250,000, depending on:

• Target class (enterprise vs consumer)
• Exploit reliability
• Public awareness (true zero-days have no CVE yet)
• Packaging (standalone exploit vs PoC with loader)

In many cases, these are purchased by ransomware groups or APT teams for sustained exploitation campaigns. Some come with exploit chains, combining privilege escalation + sandbox escape + persistence.

8. Emerging Trends in Dark Web Threat Economy

The dark web continuously adapts to detection advancements, with cybercriminals now leveraging AI, blockchain vulnerabilities, and behavioral targeting to increase attack efficiency.

1. AI-Powered Phishing & Deepfakes

Phishing kits now include:

• GPT-generated spear-phishing emails based on LinkedIn/job data
• Chatbots for real-time impersonation (e.g., fake HR or IT)
• Deepfake voice modules mimicking executives for vishing scams

Example: PhantomTalker v3 offers email, chatbot, and voice deepfake tools with a built-in Slack mimic UI.

2. Crypto Drainers & Smart Contract Abuse

Telegram bots and malicious smart contracts:

• Auto-drain wallets on transaction approval (Ethereum, Solana, BNB)
• Come with fake airdrop/phishing pages and real-time alerting
• Prices range from $300–$1,500, with profit-share models

Over $1.3M stolen in Q2 2024 alone via clipboard hijacking and drainers (Chainalysis).

3. Data Enrichment-as-a-Service (DEaaS)

Attackers now offer target profiling tools that combine:

• Leaked Fullz + OSINT + behavioral fingerprinting
• AI to classify targets (elderly, crypto-holders, execs)
• Synthetic identities for testing anti-fraud systems

DEaaS enables “conversion-optimized” scams with segmentation logic similar to ad platforms.

How to Protect Your Data from Being Sold on the Dark Web

Once your personal information hits the dark web, it spreads fast — and silently. But you don’t have to wait for a breach notification email to know you’ve been compromised.

PureVPN’s Dark Web Monitoring acts as your digital watchdog. It continuously scans underground marketplaces, breach forums, and leaked credential dumps for any trace of your email, passwords, or identity markers.

The moment it detects your information on the dark web, you get an instant alert — giving you a head start to reset passwords, freeze accounts, or secure your identity before damage is done.

Frequently Asked Questions

Source: https://threatintelligencelab.com/blog/types-of-data-cybercriminals-sell-on-the-dark-web/