What Gets Sold and How
What your customers’ data is worth on the Dark Web
What Is the Dark Web?
A lot of people have heard of the term but don’t understand the meaning of it. To grasp what it implies, you must understand that the internet has three layers.
The surface web is what most people use every day, for example; Google, news sites, social media. Basically, anything you can find through a search engine. Below that is the deep web that makes up about 90% of the entire internet. This includes things like your email inbox, online banking portal, medical records and private database that require login to access. Most people visit the deep web every single day without realizing it.
The last layer is the dark web. It’s a very small hidden section of the deep web that makes up only about 0.01% of the internet. One cannot access the dark web through regular browsers like Safari, Firefox or Chrome. It requires special software called the Tor Browser which one could download easily if they desired. Tor Browser hides your identity by bouncing your connection through multiple servers around the world. Dark web sites don’t use regular addresses like .com or .org. They use .onion addresses that aren’t searchable and accessible to the general public.
What Gets Sold and What Does It Cost?
This is where things get concerning, the dark web operates like an underground Amazon for stolen data and your customers’ financial information is one of the hottest items on the market.
According to Recorded Future, more than 140 million stolen credit card records appeared on dark web marketplaces in 2025. This number is mind-boggling and it doesn’t even account for bank login credentials, identity packages and other financial data also being traded.
The table below contains what criminals are actually paying for your customers’ data right now, based on SOCRadar’s Annual Dark Web Report 2025.
| What Is Being Sold | Average Price |
| Personal data (name, phone, address) | $1 – $4 |
| Social Security Number | $1 – $6 |
| US Credit Card with CVV | $10 – $40 |
| Full Identity Package “Fullz” (name, SSN, DOB, address | $20 – $100 |
| High Limit Credit Card (over $5000) | $110 – $120 |
| Online Bank Login (depends on how much money is in the account) | $200 – $1000+ |
The crazy part about this list is the bank login. Criminals can now purchase direct access to one of your customers’ bank accounts for as little as $200. The higher the account balance the higher the price, but even a few hundred dollars is amazingly low cost for the kind of damage that can follow.
How Does Bank Data End Up There?
According to the Verizon 2025 Data Breach Investigations Report, stolen credentials were involved in 32% of all breaches, and 88% of web application attacks used stolen credentials as the entry point. Bank Data ends up on the dark web in two main ways:
Phishing attacks – Customers and bank employees receive convincing fake emails from what look likes a trusted company. They click the link, enter their login credentials on a fake page and hand everything over without realizing it.
Data Breaches – A bank, vendor or any third party that handles customer data gets attacked and confidential/sensitive records are stolen. Once compromised and the data is in criminals’ hands, it is typically sorted, packaged and listed for sale on dark web markets within 24-48 hours. The Verizon DBIR also found that third party involvement in breaches doubled year over year, jumping from 15% to 30%. Vendors are usually a direct line to your customers’ data.
What Can Banks Do About It?
Good news there are concrete steps community banks can take to get ahead of this threat before it turns into a crisis.
Dark web monitoring – This is probably the most direct defense; however, a lot of smaller institutions/community banks have not implemented this yet simply they are not aware it exists or have not made it a priority. These dark web monitoring services continuously scan underground marketplaces and forums looking for your institution’s data, your customers’ credentials and your employees’ login information. If something shows up, you get alerted before a criminal has a chance to act on it. According to IBM’s Cost of a Data Breach Report 2026, financial services breaches now cost an average of $6.29 million. Catching an exposure early is far cheaper than responding to a full breach.
Employee training – Since stolen credentials are involved in nearly a third of all breaches, training your team to spot phishing emails and suspicious login requests is one of the most cost-effective defenses there is. If no one hands over their credentials the attack cannot start.
Vendor risk management – With third party involvement in breaches doubling according to Verizon’s 2025 report, knowing the security posture of every vendor with access to your systems is very critical. Any vendor connected to your institution is a potential entry point for attackers and a potential source of customer data ending up on the dark web.
Strong authentication – Having Multi-Factor Authentication (MFA) setup across employee and customer accounts makes stolen credentials significantly less useful even if they end up on the dark web. A password alone is not enough protection anymore.
Closing Thoughts
The dark web isn’t some distant problem that only affects big banks. It’s an active marketplace running around the clock where your customers’ data has a price tag and criminals are shopping. Local/community sized banks aren’t too small to be targeted, if anything, smaller institutions with fewer security resources are more attractive because the barriers to getting in are lower. This is why it’s important to have defensive security measures in place.
