McAfee Labs (a division of Intel Security) has released a new report that provides a fascinating insight into how different types of stolen data are being packaged and sold online.

The Hidden Data Economy report (pdf) examined pricing for stolen credit and debit card data, bank account login credentials, stealth bank transfer services, online payment service login credentials, premium-content-service login credentials, enterprise network login credentials, hospitality loyalty account login credentials, and online auction account login credentials.

The “cybercrime-as-a-service” marketplace is described as broad, with a multitude of data types for sale and marketplaces that extend across both the normal web and into various recesses commonly referred to as the Darkweb.

Prices charged for the data naturally varied across what was being offered, where the data was sourced from, and its potential value to bad actors with the average estimated price for stolen credit and debit cards coming at a $21 to $40 for those stolen from Australia; $5 to $30 from the United States; $20 to $35 from the United Kingdom; $20 to $40 from Canada; and $25 to $45 in the European Union.

Bank login credentials for a $2,200 balance bank account selling for $190, while bank login credentials plus stealth funds transfers to U.S. banks priced from $500 for a $6,000 account balance, to $1,200 for a $20,000 account balance; bank login credentials and stealth funds transfers to U.K. banks range from $700 for a $10,000 account balance, to $900 for a $16,000 account balance

Online payment service login credentials were priced between $20 and $50 for account balances from $400 to $1,000; between $200 and $300 for balances from $5,000 to $8,000.

“Like any unregulated, efficient economy, the cybercrime ecosystem has quickly evolved to deliver many tools and services to anyone aspiring to criminal behavior,” Intel Security Chief Technology Officer for Europe, the Middle East, and Africa Raj Samani said in a post to the McAfee Labs blog. “This ‘cybercrime-as-a-service’ marketplace has been a primary driver for the explosion in the size, frequency, and severity of cyberattacks. The same can be said for the proliferation of business models established to sell stolen data and make cybercrime pay.”

Financial services weren’t the only products listed in the report, with account login credentials to online content services such as online video streaming being offered for $0.55 to $1; premium cable channel streaming services for $7.50; premium comic book services $0.55; and professional sports streaming $15.

Researchers also found that login credentials to hotel loyalty programs and online auction accounts are often offered for sale as well, allowing buyers to conduct online purchases under the guise of their victims.

A major hotel brand loyalty account with 100,000 points was found for sale for $20, and an online auction community account with high reputation marks priced at $1,400.

The findings come after a bad year for major data breaches, including companies such as CVS, Anthem, Carefirst, and even the Internal Revenue Service.

Image credit: McAfee Labs