Data breaches have become common, andbillions of records are stolen worldwide every year.
But what happens to the data that is stolen during these incidents?
As acybersecurity researcher, I track data breaches and the black market in stolen data.
Sometimes when data is stolen by national governments it is not disclosed or sold.
Instead, it is used for espionage.
The key suspects in this incident were hackers backed by the Chinese government.
It’s free, every week, in your inbox.
But the majority of hacks seem to be about selling the data to make a buck.
Stolen data often ends up being sold online on thedark web.
For example, in 2018 hackersoffered for sale more than 200 million recordscontaining the personal information of Chinese individuals.
This included information on 130 million customers of the Chinese hotel chain Huazhu Hotels Group.
Similarly, data stolen fromTarget,Sally Beauty,P.F.
Chang,Harbor FreightandHome Depotturned up on a known online black-market site calledRescator.
Buyers can purchase the data they are interested in.
The most common way to pay for the transaction is with bitcoins or via Western Union.
The prices depend on the bang out of data, its demand and its supply.
Where stolen data goes
Buyers use stolen data in several ways.
Credit card numbers and security codes can be used to create clone cards for making fraudulent transactions.
Sometimesstolen personal information is purchasedbymarketing firmsor companies that specialize in spam campaigns.
Buyers can also use stolen emails in phishing and other social engineering attacks and to distribute malware.
Hackers have targeted personal information and financial data for a long time because they are easy to sell.
Health care data hasbecome a big attraction for data thievesin recent years.
In some cases the motivation is extortion.
A good example is the theft of patient data from the Finnish psychotherapy practice firm Vastaamo.
At least 300 of thesestolen records have been posted online, according to an Associated Press report.
Stolen data including medical diplomas, medical licenses and insurance documents can also be used toforge a medical background.
The first step is to find out if your information is being sold on the dark web.
you’re free to use websites such ashaveibeenpwnedandIntelligenceXto see whether your email was part of stolen data.
you might also report the incident to the Federal Trade Commission to get atailored planto recover from the incident.
