Tracing the Steps: How Stolen Data Ends up on the Dark Web
Data is the ultimate “black gold” of the digital economy.
The commercial significance of personal data is undisputed, with a bustling economy that supports giant databases of sensitive information.
Personal data drives organizational functions with individual information being a critical fiber in business.
In fact, some organizations can only be valued by the scale of data that they own or control.
Interestingly, the importance of personal data to legitimate businesses weighs similarly, or perhaps exceeds, that of the cybercriminal realm.
The dark web has established a booming economy that thrives on identity theft through the unauthorized utilization of personal information in crime.
In actuality, there exists an underground world that is sustained by a hidden courtyard built on the constructs of stolen data.
Being a hot cake within the darknet corridors, personally identifiable information (PII) is routinely sold or rented with the sole intention of realizing financial gains.
Stolen Data on Demand
There are various types of data for sale on the dark web, but we shall focus on a few main ones.
Arguably, financial data tops the list of the most common forms of personal information that is traded online.
Financial data has been implicated in many cases involving data breaches that target user payment card information.
Expectedly, retail organizations form the bulk of entities that have suffered financial data theft for a long time.
Login access is another type of data used by criminals to perpetrate fraud-related crimes.
Login access denotes the information necessary for permitting entry into organizational systems within defined networks.
Entry types include the simple kind (login details) and the more technical forms that may be used by criminals to permeate through cybersecurity protocols.
Access to online services refers to personal data used in digital subscriptions. Netizens access online content through subscription plans provided by websites.
It is quite surprising to realize that this form of data appeals to dark web criminals that apply it as fraud fodder.
When stolen, this type of data can be used to breach online accounts with the aim of carrying out illicit activities.
In this regard, the credentials of a legitimate account owner may be used to make online purchases owing to the criminal possession of stored credit card information.
Moving further, health records are in high demand on the hidden web. In fact, it is said that stolen medical information is several times more valuable than financial data sold on the dark web.
But why?
Data breaches involving medical data are hard to detect since most patients would take a long time to discover the theft.
This is a sharp contrast with cases involving financial data where a victim may notify their bank about a data breach, which would solve the problem forthwith.
The Conundrum of Data Theft
Data theft presents many facets, and has become a growing concern for individuals and organizations alike.
A publication by the Identity Theft Resource Center indicated that U.S. data breaches peaked in the year 2017 with the exposure of more than 170 million records.
Data Harvesting Tactics
There are a host of methodologies used by dark web masterminds to harvest personal data illegally.
These techniques have evolved over the years according to the ever-changing technological infrastructures that define contemporary information and communications technology (ICT).
Indeed, the main conduit for stolen data is through data breaches that are engineered by cybercriminals.
There exists particular categories of data breaches used to describe data theft incidents. The main ones include:
- Insider theft
- Hacking / Skimming / Phishing
- Physical theft
- Data on the move
- Online exposure
Ideally, data breaches involving hackers are not the only channels implicated in the availability of stolen data on the dark web.
Sometimes, lost data finds itself in the hands of criminals. It is not surprising to come across cases of a lost computer that held critical information, which ended up being a vehicle of cybercrime.
In essence, we may not take for granted that online exposure stands to be the most efficient manner in which thieving crooks obtain personal information.
Breaches regarding email mishaps are quite common, and occur when people misaddress their online communications.
In this taste, programmatic issues may cause data leaks and the resulting sale of user information on the dark web.
In other times, human error may be blamed on email mishaps, leading to the leaking of private patient information in the context of healthcare records.
Similarly, it is noteworthy to realize the potential of data breaches regarding paper mail.
Physical letters, if improperly addressed, may cause harm to the supposed recipients owing to the senders’ downright negligence or human error.
A Case Study
While email-related cases may not affect a significant portion of a populace, misaddressed emails or physical letters have led to serious litigations and costly consequences involving major U.S. institutions.
One notable incident involved that of Aetna Inc., a health organization, in what was described as the world’s largest HIV privacy data breach.
In the 2017 case, it is reported that Aetna had sent letters to its customers across U.S. states with the intention of notifying them about the upcoming HIV prescription plans.
In the letters, the members’ drug information could be read via the large-windowed envelopes.
The Aetna incident sparked a spate of lawsuits and settlements that forced the company to part with a startling $17 million.
What Then Happens to Your Stolen Data?
Data thieves steal personal information before trading it on the dark web.
Following a breach, data criminals often utilize the hidden platforms on the dark web to buy and sell personal information in a controlled environment.
The availability of this data on darknet platforms encourages other criminals to purchase the stolen data to commit fraud and other forms of criminality.
Fraudsters use people’s data to establish fake identities to be used in other cyber activities that promise economic returns.
The range of options available to a cybercriminal would dictate what they would do with harvested data.
Most commonly, user credentials allow data thieves to take over financial accounts and customize them to befit their needs.
A criminal may simply make withdrawals from a victim’s bank account and make away with loads of money in a single shot.
In the context of stolen health records, data thieves may establish fake identities to be used in procuring medical products and services.
Even shockingly, a fraudster may connect a stolen patient’s ID with that of a false provider and file a fictitious claim with health insurers.
The problem with darknet-supported data theft is that the personal information available to criminals lacks an expiration date.
In this sense, they may use an individual’s personal data for years after a single data breach.
This means that the form of darknet cybercrime described hereto can cause prolonged damage to its victims, with the associated economic and social ramifications.
Just to highlight, some data thieves keep stolen data for long periods before using the records.
This tactic allows them to take advantage of breach fatigue, which is likened to a reduction in victim anxiety and vigilance following an attack.
They would then execute ambitious fraud schemes under the noses of unsuspecting consumers and organizations.
But just how much value does your personal data hold?
And how important is it to a thieving darknet criminal?
The answers to these critical questions lie in the risks associated with identity theft.
A Plethora of Risks
Data theft presents itself in a variety of ways and forms. The risks predisposed to its victims are often financial or reputational in design.
The sufferers of crimes involving personal data are likely to lose colossal amounts of money and spend lots of time attempting to solve their problems.
This aspect presents itself in cases where criminals have successfully gained access to a user’s multiple accounts.
In the reputational sense, dire emotional consequences befall victims of data theft when their social integrity is on the line.
A victim may experience heightened levels of rage regarding their predicament and may lose trust in important systems that affect their professional lives.
In addition, a victim may feel shame after falling prey to online scams that target personal data.
It is a known fact that scammers have mastered the art of packaging their “baits” in ways that would be downplayed by gullible targets.
Victims of such scamming schemes may partly blame themselves for not detecting any foreplaned foul play.
E-Commerce: A New Cybercriminal Frontier
Not long ago, point-of-sale (POS) systems had surely been a favorite target of malware creators that aimed to steal personal data.
POS terminals are, in simple terms, cash registers that allow organizations to monitor their inventories and study transactions.
Unfortunately, these systems are usually prone to cyberattacks and the eventual data breaches that rule the online universe.
In recent times, POS systems have become less appealing to hackers since ICT experts tweaked their vulnerabilities.
The EMV (Europay, Mastercard and Visa) chip technology has stepped in to the financial industry to offer unmatched security.
The new technology creates a unique transaction code whenever a card is used to enable maximum security.
You might be wondering, does this enable total protection against data thieves?
Cybercriminals are very good at their craft, and they adjust to changing situations accordingly.
Current data breaches are mainly orchestrated by data breaches targeting e-commerce transactions.
E-commerce platforms have erased the need to store user data on chips, but instead allow people to input their personal information online.
Such information may include, but not be limited to, names, addresses, credit card numbers and dates of birth.
At this point, cybercriminals may use malware to redirect oblivious users to pages designed for data harvesting. In other cases, people’s personal details may be lifted directly from the platforms illegally.
Conclusion: The Silver Bullet
The expected growth in popularity of darknet platforms will surely culminate in problematic situations for data storage and management.
Data theft is still the problem of this era and threatens the corporate integrity of global economic systems.
Nonetheless, security experts have provided interventions that will surmount data breach campaigns to protect users from identity theft rings.
To underscore, personal data may well be protected through healthy password practices and the use of anti-malware tools.
Additionally, people must guard their personal details by being mindful of what information they avail online.
What’s the bottom line?
Prevention is better than cure.
While data breaches can occur beyond the control of a common internet user, vigilance and online monitoring can insulate people from suffering the financial and reputational damage that accompany the incidents of data theft.
No comments:
Write comments