Is my information on the dark web? Prices, uses and next steps

How your data gets onto a dump

WeLiveSecurity, the blog of the security company ESET, lists five routes in an article of 13 January 2026 by which personal information, credentials and financial data end up with cybercriminals: data breaches, infostealer malware, phishing, accidental leaks and supply chain attacks. It adds data brokers as another weak link, because they collect information legally from the web and tracking but may not protect it well.

On breaches, ESET says the United States recorded 1,732 incidents in the first half of 2025, leading to over 165.7 million breach notifications, and that double extortion ransomware, where data is stolen to pressure the victim company, adds to the risk. Papaya Privacy, a company that sells monitoring, quotes the Identity Theft Resource Center for a bigger count: 471.2 million victim notices in the first half of 2026, against 297.5 million in all of 2025. We did not read the Identity Theft Resource Center itself, and the two pages count different periods, so the figures do not line up as a trend.

Infostealer malware, ESET says, has become popular through as-a-service kits such as RedLine and Lumma Stealer, and can hide in legitimate-looking mobile apps, web pages, malicious ads and phishing links or attachments. It often takes both credentials and session cookies, which ESET says makes it easier to get past multi-factor authentication. A database left open by a misconfigured cloud system can be stolen and sold if it stays open long enough. In a supply chain attack the company that is hacked is a supplier or partner: ESET gives the 2023 attack on the MOVEit file transfer software, which it says compromised thousands of organizations and over 90 million downstream customers.

Experian, which sells a monitoring membership, gives a shorter list with one route ESET does not: lost or stolen mail and documents, from which criminals sell stolen bank checks or customer accounts. The table below sets the two pages side by side.

What a dump can contain

Experian lists what criminals sell on the dark web: names, addresses and phone numbers; Social Security numbers; emails, usernames and passwords; medical records and account numbers; financial account numbers and details; and driver’s license and passport information. Bitdefender, a security company, says the marketplaces that trade it often look like online shops and sell large batches of personal information from users across the globe.

ESET says what criminals really want is financial information, meaning bank account numbers, card details and logins, along with personally identifiable information and account logins. It singles out two things. Biometric data is particularly sensitive, it says, because it cannot be reissued or reset like a password. Session tokens and cookies are useful because they can help get around multi-factor authentication.

Not every package holds the same things. Comparitech, in a report covered by TechRepublic on 8 February 2021, says the stolen identities it found varied: some held a Social Security number, a name and an address, while more extensive ones came with utility bills, bank statements or a driver’s license number, and some with photos of a person or of a passport or driver’s license. Cards, it says, are sold in bulk packages generally resulting from some kind of breach or attack. Its author adds that Social Security numbers and other national ID numbers are for sale but are not particularly useful to criminals on their own, because they are usually accompanied by a name, date of birth, address and account numbers. The pages we read do not say what share of a dump is actually sold.

What it sells for, and why the numbers disagree

Three price indexes turned up. Privacy Affairs, in a study reported by Help Net Security on 19 June 2020, says its team scanned dark web marketplaces, forums and websites. It puts an online banking login at $35 on average and a full card with associated data at $12-20. A full range of documents and account details for identity theft costs $1,285 in the text and $1,500 in the opening list, and swapping a European ID for a US passport adds $950, for a total of $2,235.

The same company’s press release of 1 May 2023, on PR Newswire, says an individual’s personal information is valued at $1,010. Its figures do not agree with one another: a banking login costs an average of $100 in the opening points and $30 in the text, and $150 in the list of items, where it carries a minimum of $100 on the account. A card costs $10-100 in the text and $110 in the list. The list of items, which includes a US driving license at $500, a US ID card at $200 and a hacked Facebook account at $25, totals $985, against $1,010 in the opening paragraph. Swapping the ID card for a European passport adds $3,000, for a total of $5,010. The release also prices hacked cryptocurrency accounts: Coinbase $610, LocalBitcoins $350 and Kraken $810.

Comparitech, through TechRepublic in February 2021, reaches a very different figure for a US identity: personal information from US citizens is worth “just $8” on average, while Japan, the United Arab Emirates and EU countries have the most expensive identities, at an average of $25. Stolen cards run from 11 cents to nearly $1,000 and PayPal accounts from $5 to $1,767. The report looked at nearly 50 marketplaces. It also says the median credit limit on a stolen card is 24 times the price of the card, and the median balance of a hacked PayPal account 32 times its price.

The pages do not explain the gaps, but the differences are visible. Comparitech’s $8 is an average per record (the researcher quoted calls it about $8 a record), while Privacy Affairs prices a bundle of documents and accounts, so the two are not like for like; the TechRepublic article itself says some of the packages it counted included utility bills, bank statements or photos of documents. The two Privacy Affairs editions give different figures, the 2020 article does not itemize its bundle, and the 2023 release is inconsistent with itself. The Privacy Affairs researcher quoted in the release says the prices are about what a person’s financial details or social media logins are worth to a criminal, and that the person probably values them much more. All three indexes are scans by a research team or a company, not an audited market statistic, and the pages we read do not say what any one person’s own records are worth or whether the listings sold. The pages we read include no index later than 2023.

What buyers do with it, and how long it takes

Bitdefender, in an article of 13 October 2021 that ends by pointing readers to its own tool, describes a lag. After a breach, it says, the thieves index the data and look for highly profitable accounts, then bundle the goods and sell them in bulk. That process can take months, and by the time the data is sold, login datasets may be worth less to an attacker because the breached organization has already patched its flaws and told its users. ESET frames it more sharply: if data is on the dark web, it says, it is probably only a matter of time before it is abused for fraud or account hijacking.

Old data still gets used. Bitdefender says criminals use old login credentials in phishing or extortion emails, for example a message that claims a device was hacked and a video recorded, with an old password added to make it believable. It sums this up as “old data has no expiration date”. It also says criminals cross-check dumped logins against other dumps to find reused passwords, use stolen phone numbers for fake text messages, and sell card details in bundles to buyers who use them for prepaid gift cards or cloned cards. Social Security numbers, addresses, names and dates of birth can go into new account fraud and tax return fraud.

ESET adds that criminals can hijack accounts to drain them of data and money, use personal details in follow-on phishing, or apply for new lines of credit, medical treatment or welfare benefits. Experian’s list is close: selling the data on, taking over accounts and sometimes changing the password so the owner cannot log back in, new accounts, medical identity theft, false tax returns and government benefits such as unemployment. Victims, Bitdefender says, can take “weeks, if not months” to notice anything on their accounts. The pages we read give no average time between a breach and a sale beyond the months Bitdefender mentions.

Checking, and removing

The pages that explain how to check are mostly written by companies that sell the check. Experian offers a free one-time scan for a Social Security number, an email address and a phone number, and says its scan “looks back to 2006” and searches over 600 thousand pages. Its paid plan watches over 600 thousand websites daily and includes up to $1 million of identity theft insurance. Papaya Privacy sells continuing monitoring and a $1 million insurance that it says covers recovery costs, not stolen funds. ESET says identity protection services such as HaveIBeenPwned can look for your details and alert you if they appear; our page on whether Have I Been Pwned is safe covers that service, and our page on dark web scans covers what an alert can and cannot reach.

One check is gone. Google Search Help says the dark web report, meant to scan the dark web for your personal information, stopped scanning for new breaches on 15 January 2026 and was no longer available from 16 February 2026, when all its data was deleted. It gives its reason: the report offered general information, but feedback showed it did not provide “helpful next steps”.

Two of the pages answer the removal question directly. ID Watchdog asks whether you can remove your information from the dark web and answers no: because of its anonymous nature, there is no way to search for every organization holding your data or to hold anyone accountable for removing it. Papaya Privacy says none of it can be deleted, that no request pulls it back, and that any service claiming otherwise is overselling. ESET’s advice to send “right to be forgotten” requests is about data brokers, which is a different store. The pages we read do not say whether an alert names the breach or its date.

What to do, by kind of data

ID Watchdog, which sells identity protection, sorts its steps by what was exposed, and the table below sets them out. It says an alert is likely not an occasion to full-on panic but probably suggests some next steps, and that although the data cannot be removed, knowing what was compromised helps you protect yourself from future fraud. For a notice from a company that was breached, it says the answer depends on what the company held: with an account login, reset the password using a password manager, add two-factor authentication, and reset any account that shares the same or a similar password. It also suggests a credit lock, freeze or fraud alerts. Our pages on freezing or locking credit, what someone can do with a passport number and card fraud go further on three of these.

ESET gives a longer list. Change compromised passwords and keep unique ones in a password manager; switch on multi-factor authentication with an authenticator app or a hardware security key, rather than SMS, which it says can be intercepted; sign out of all devices to stop anyone holding stolen session cookies; contact the bank, freeze the cards and have them reissued; freeze credit with each of the main bureaus; scan devices for infostealer malware; and report the leak to the FTC in the United States, Report Fraud in the United Kingdom or the relevant European authorities.

Experian’s list overlaps: change passwords, turn on multifactor authentication, monitor bank and card statements, check credit reports at all three bureaus, place a fraud alert or credit freeze, and report identity theft to the FTC, the FBI and local law enforcement. The lists differ in small ways. ESET ranks an authenticator app or hardware key above SMS, ID Watchdog speaks of an extra code or a physical key without ranking them, and Experian does not name a kind. ID Watchdog, Experian, Bitdefender and Papaya Privacy sell protection or monitoring, so we use them for what they say, not as a recommendation.