Dark Web Price Index 2026: what stolen data actually costs
A cloned Visa with the PIN included listed for about $20 on dark web markets, while verified logins for a major European bank account asked more than $4,000 in the same price index. Both numbers describe the same underground economy, and both come with a caveat that matters more than the figures themselves: they are asking prices, scraped from public listings, not records of completed deals.
How a price index for illegal goods is built
Privacy Affairs has published its Dark Web Price Index since 2020, scanning markets, forums and websites to average the prices of a basket of illicit goods; its 2023 edition is still the one other vendors cite as the reference point for these levels. SOCRadar published a comparable index in July 2026 from its own annual dark web reporting. The method is the same: watch the listings, record what sellers ask. As Privacy Affairs put it:We gather data by scanning Dark Web marketplaces, forums, and websites. This information is then processed to generate an index of average prices for a broad range of specific products.What that method cannot see matters. A scraped listing is an asking price; it says nothing about discounts, about how often a listing actually sells, or about what share of the data inside still works. The index is a thermometer, not a ledger: it reads the temperature of supply and demand without measuring the volume of trade. SOCRadar presents its 2026 figures as ranges for the same reason — prices shift with data freshness, completeness and seller reputation.
What stolen data listed for
- Card data: card details with a balance up to $5,000 listed at $110 in Privacy Affairs' 2023 tables, down from $120 a year earlier, with cloned cards including PIN at $20. SOCRadar's 2026 index puts US cards with CVV at $5 to $50 and high-balance cards at roughly $110–120, eroded from a peak near $240 in 2020–2021.
- Banking logins: plain logins with modest balances listed at $40–60; the top prices went to verified, KYC-complete accounts — ING logins at $4,255, an HSBC UK business account at $4,200, Swiss online banking at $2,200. The 2026 range is $200–500 for low-balance logins and $1,000 and up for high-balance ones.
- Identity documents: scans of IDs, passports and driver's licenses run $30–60 in 2026; Privacy Affairs' 2023 tables showed US passport scans at $50, Russian passport scans at $80 and a selfie holding an ID at $110, while forged physical EU passports listed at $3,000–4,000.
- Hacked accounts: Gmail at $60, Facebook and Instagram at $25, Twitter at $20 in 2023; social accounts range $20–50 in 2026. Verified crypto-exchange accounts sit above them — a verified Kraken account asked $1,170 in 2023, with 2026 ranges from $100 to over $1,000.
- Stealer logs and tooling: stealer malware starts at $15, single logs sell for $5–50, and adversary-in-the-middle phishing panels rent at $120–350 per month. A log under 48 hours old can cost several times an older one, because its session cookies still work.
- Corporate access: initial access brokers list footholds from the low thousands of dollars, with domain or cloud-admin access to large enterprises reaching six figures — the wholesale tier ransomware crews buy from.
What moves the prices
- Supply: data leaks make up 64.06% of dark web activity in SOCRadar's 2026 measurements. Years of breaches plus industrial-scale infostealers keep the floor cheap — personal records at $1–4, Social Security numbers at $1–6.
- KYC pressure: everything behind completed identity verification trades at a multiple. The $4,255 ING listing is a verified account, not a bare credential; the stricter platforms get, the scarcer — and pricier — verified accounts become.
- Bank controls and region: US payment cards are the cheapest because the US floods the market; cards from countries with lower supply and stricter fraud detection cost more.
- Freshness and MFA: recent, valid, complete data outsells stale data, and access confirmed to defeat multi-factor authentication carries a markup — the niche that AiTM phishing subscriptions monetize.