Glut of Stolen Banking Data Trims Profits for Thieves

A massive glut in the number of credit and debit cards stolen in data breaches at financial institutions last year has flooded criminal underground markets that trade in this material, driving prices for the illicit goods to the lowest levels seen in years, experts have found.

For a glimpse of just how many financial records were lost to hackers last year, consider the stats released this week by Verizon Business. The company said it responded to at least 90 confirmed data breaches last year involving roughly 285 million consumer records, a number that exceeded the combined total number of breached records from cases the company investigated from 2004 to 2007. Breaches at banks and financial institutions were responsible for 93 percent of all such records compromised last year, Verizon found.

As a result, the stolen identities and credit and debit cards for sale in the underground markets is outpacing demand for the product, said Bryan Sartin, director of investigative response at Verizon Business.

Verizon found that profit margins associated with selling stolen credit card data have dropped from $10 to $16 per record in mid-2007 to less than $0.50 per record today.

According to a study released last week by Symantec Corp., the price for each card can be sold for as low as 6 cents when they are purchased in bulk.

"[Cyber thieves] now have their hands on a tremendous amount of data, and there's certainly no scarcity of it out there right now," said Alfred Huger, vice president of development at Symantec. "Given all that we've seen in the past year, we're not sure why we haven't seen even more of a drop in pricing, but it could be that the people doing the selling have sewn up the market and no longer have to worry about being undercut by other sellers."

Steve Santorelli, director of investigations at the private security research firm Team Cymru, said his group's monitoring of cyber criminal forums appear to support Huger's hunch: Many forums are simply restricting the registration of new "verified" members. Getting verified involves successfully conducting a number of transactions with other members to demonstrate that the new entrant is not merely a "ripper," someone who will abscond with the money or goods before a transaction is completed.

"The rate of new additions allowed into the miscreant verified lists is very low," Santorelli said.

What's more, Santorelli said, thieves in possession of huge troves of stolen credit and debit card data appear to be hoarding the credentials, releasing them onto the market in smaller chunks in an effort to control the overall supply of card data available at any one time.

"This results in lower average prices for buyers and some sellers stockpiling products to restrict supply in a bid to keep prices inflated," he said.

YOU CAN USE QUICK SEARCH ENGINE IN THE TOP FOR MORE DOWNLOADS OR DETAILS.