The Economic Impact of Stolen Data Markets

Part of the Palgrave Studies in Cybercrime and Cybersecurity book series (PSCYBER)


This chapter provides an in-depth analysis of the factors that may affect the price and profits received by data buyers and vendors within the market for stolen data. First, the issue of “lemon markets” is discussed, where the lack of information on the quality of data may lead to lower-priced data of low value dominating the market. Using linear regression models, we find that the price for dumps and eBay accounts are directly affected by social factors including the language of participants which may be a proxy for trust. Additionally, we discuss the challenges inherent in modeling the profit margins of data buyers and sellers. The prospective earnings of vendors are explored, suggesting they may make thousands of dollars depending on the product, while buyers could earn millions but face greater risk of economic loss.


Profits Lemon market Ripping Language Dumps 


  1. Akerlov, G. A. (1970). The market for “lemons”: Quality, uncertainty, and the market mechanism. The Quarterly Journal of Economics, 84, 488–500.CrossRefGoogle Scholar
  2. Cashell, B., Jackson, W. D., Jickling, M., & Webel, B. (2004). The economic impact of cyber-attacks. Congressional Research Service, Library of Congress.Google Scholar
  3. Computer Security Institute. (2010). Computer crime and security survey. Retrieved June 3, 2011, from
  4. Dhanjani, N., & Rios, B. (2008). Bad sushi: Beating phishers at their own game. Presented at the Annual Blackhat Meetings, Las Vegas, NV.Google Scholar
  5. Franklin, J., Paxson, V., Perrig, A., & Savage, S. (2007). An inquiry into the nature and cause of the wealth of internet miscreants. Paper presented at CCS07, October 29–November 2, 2007, Alexandria, VA.Google Scholar
  6. Harrell, E., & Langton, L. (2013). Victims of Identity Theft, 2012. Washington, DC: US Department of Justice, Bureau of Justice Statistics. Retrieved from
  7. Herley, C., & Florencio, D. (2010). Nobody sells gold for the price of silver: Dishonesty, uncertainty and the underground economy. In T. Moor, D. J. Pym, & C. Ioannidis (Eds.), Economics of information security and privacy (pp. 35–53). New York: Springer.Google Scholar
  8. Holt, T. J. (2013). Exploring the social organization and structure of stolen data markets. Global Crime, 14, 155–174.CrossRefGoogle Scholar
  9. Holt, T. J., & Kilger, M. (2012). Know Your Enemy: The social dynamics of hacking. The Honeynet Project. Retrieved from
  10. Holt, T. J., & Lampke, E. (2010). Exploring stolen data markets on-line: Products and market forces. Criminal Justice Studies, 23, 33–50.CrossRefGoogle Scholar
  11. Holt, T. J., & Smirnova, O. (2014). Examining the structure, organization, and processes of the international market for stolen data. Washington, DC: US Department of Justice. Retrieved from
  12. Holt, T. J., Smirnova, O., & Chua, Y.-T. (2013). An exploration of the factors affecting the advertised price for stolen data. eCrime Researchers Summit (eCRS), 2013, pp. 1–10. IEEE.Google Scholar
  13. Holt, T. J., Smirnova, O., Chua, Y.-T., & Copes, H. (2015). Examining the risk reduction strategies of actors in online criminal markets. Global Crime, 16(2), 81–103.Google Scholar
  14. Kshetri, N. (2006). The simple economics of cybercrimes. Security & Privacy, IEEE, 4(1), 33–39.CrossRefGoogle Scholar
  15. McAfee. (2013). The economic impact of cybercrime and cyber espionage July 2013. Center for Strategic and International Studies, McAfee. Retrieved from
  16. McAfee. (2014). Net losses: Estimating the global cost of cybercrime (economic impact of cybercrime II). Center for Strategic and International Studies, McAfee.Retrieved from
  17. Moore, T., Clayton, R., & Anderson, R. (2009). The economics of online crime. Journal of Economic Perspectives, 23(3), 3–20.CrossRefGoogle Scholar
  18. Motoyama, M., McCoy, D., Levchenko, K., Savage, S., & Voelker, G. M. (2011). An analysis of underground forums. IMC’11, 71–79.Google Scholar
  19. Olivier, J., & Norberg, M. N. (2010). Positively skewed data: Revisiting the box-cox power transformation. IJPR, 3, 68–75.Google Scholar
  20. Peretti, K. K. (2009). Data breaches: What the underground world of “carding” reveals. Santa Clara Computer and High Technology Law Journal, 25, 375–413.Google Scholar
  21. Ponemon Institute. (2014). 2014 Cost of Cyber Crime Study: United Kingdom. Traverse City, MI: Ponemon Institute.Google Scholar
  22. Schneider, J. L. (2005). Stolen-goods markets: Methods of disposal. British Journal of Criminology, 45, 129–140.CrossRefGoogle Scholar
  23. Seals, T. (2014). 2014 so far: The year of the data breach. Infosecurity Magazine, August 12. Retrieved from
  24. Stone-gross, B. Abman, R., Kemmerer, R. A., Kruegel, C., Steigerwald, D. G., & Vigna, G. (2013). The underground economy of fake antivirus software. In Economics of Information Security and Privacy III (pp.58-78). Springer: New York.Google Scholar
  25. Symantec Corporation. (2012). Symantec Internet security threat report, Volume 17. Retrieved from
  26. Wehinger, F. (2011). The Dark Net: Self-regulation dynamics of illegal online markets for identities and related services. Intelligence and Security Informatics Conference, 209–213.Google Scholar
  27. Yip, M., Webber, C., & Shadbolt, N. (2013). Trust among cybercriminals? Carding forums, uncertainty, and implications for policing. Policing and Society, 23, 1–24.CrossRefGoogle Scholar

Copyright information

© The Author(s) 2016

Authors and Affiliations

  1. 1.Michigan State UniversityEast LansingUSA
  2. 2.East Carolina UniversityGreenvilleUSA
  3. 3.Michigan State UniversityEast LansingUSA

Personalised recommendations