August 11, 2026
Pricing Data Is Threat Intelligence, Start Treating It That Way
Dark web market pricing is one of the more useful leading indicators of threats available to enterprise security leaders. It shows where attacker investment is concentrating, which sectors are being actively targeted, and which gaps in your control framework the criminal market has already priced in. The organizations ahead of this curve treat dark web pricing intelligence the way they treat CVE feeds: as actionable signal, not academic trivia. Here is what the 2025-2026 price data says.
Commodity Collapse and What It Signals Operationally
Prices at the low end of the stolen data market have fallen to near-throwaway levels. Individual US Social Security numbers trade at roughly $1 to $6. Minimal PII (a name paired with an email address) sells for under $15, while a full identity kit runs about $20 to $100. That kit, known as a “fullz” package, bundles a name, address, SSN, and date of birth. A standard US payment card with CVV trades between $10 and $40.
The volume behind those prices is staggering. KELA’s State of Cybercrime 2026 report identified 2.86 billion compromised credentials circulating through criminal channels in 2025 alone. Flashpoint’s midyear analysis found 1.8 billion credentials stolen in just the first half of 2025, an 800% increase over the previous six months, driven largely by infostealer malware.
The operational implication is direct: at these volumes and prices, a correct username and password is no longer meaningful evidence of identity. If your authentication architecture still treats it that way, your controls have not caught up to where the market already is.
The Premium Tier: Where Attacker Capital is Concentrating
While commodity prices deflate, the top of the market is moving the other way, though the headline number needs careful reading.
Rapid7’s research on Initial Access Brokers (IABs), the criminals who sell verified footholds inside corporate networks, found the average listing price across five major forums jumped from roughly $2,726 in 2024 to $113,275 in 2025. That is an increase of about 4,055%. The average is heavily skewed by a small number of very large listings claiming access to high-revenue victims, concentrated on the DarkForums marketplace. Typical access still sells for hundreds to a few thousand dollars, and Cyberint’s independent data put the 2024 average listing at about $1,295. The honest read: the median IAB sale stayed cheap, but 2025 saw the emergence of a new ultra-premium tier for access to large enterprises. It was also a year of major market disruption, including the BreachForums shutdown after a law-enforcement compromise in April 2025 and the arrest of the alleged XSS.is forum administrator in Kyiv that July.
Elsewhere in the premium tier, the pattern is steadier. Healthcare records held at roughly $250 to $310 per record in 2024-2025, about ten times the price of a stolen payment card, because medical history (unlike a card number) cannot be cancelled and reissued. Verified cryptocurrency exchange accounts top the consumer financial chart: a verified Kraken account has listed at up to $1,170 and a verified Binance account around $410. Coinbase accounts, once anchored near $610, have fallen to roughly $107 to $250 as stealer logs industrialized account takeover.
For security leaders in financial services, healthcare, and critical infrastructure, elevated pricing for access to your sector is a market signal of active targeting. It warrants a review of your external attack surface and lateral-movement detection coverage.
Session Cookies: The Gap the Market has Already Priced
Among credential types, listings that demonstrably bypass MFA carry a significant price premium, and stolen session cookies are chief among them. The reason is simple: when a user logs into a corporate application, the system issues a session token that keeps them authenticated. An attacker who steals that token impersonates an already-authenticated user with no password or MFA prompt required. The longer your organization lets tokens live, and the fewer device bindings placed on them, the more exploitable (and valuable) they become. That premium is the market telling you precisely where your authentication architecture is exposed. Read the signal: shorten session lifetimes, bind tokens to devices, and monitor for session replay.
AI is Creating a Quality Tier That Did Not Previously Exist
AI tooling has split the market into grades. Bulk credential dumps keep deflating on oversupply, while AI-curated datasets, sorted and precision-targeted against specific organizations or roles, command premiums reflecting their operational value to buyers.
The performance gap explains the pricing. In a controlled study by Harvard researchers, generic phishing emails achieved a 12% click-through rate, while fully AI-automated spear phishing achieved 54%. That matched human experts at a fraction of the cost. Resilience’s Midyear 2025 Cyber Risk Report cites the same comparison and found social engineering behind 88% of material insurance losses. Attackers with AI capability are producing a measurably better product, and the market is pricing it accordingly. Expect the commodity-to-premium gap to keep widening.
Key Takeaways
- Credentials are a commodity: 2.86 billion compromised in 2025 alone. Passwords plus SMS codes are no longer a meaningful identity control; move toward phishing-resistant MFA and continuous verification.
- A new ultra-premium tier for corporate network access emerged in 2025. If you operate in a highly priced sector, assume active targeting and test your external attack surface accordingly.
- Session cookies carry an MFA-bypass premium. Shorten token lifetimes, bind sessions to devices, and detect replay.
- Healthcare and financial records hold value because they are permanent. Prioritize data-loss prevention where the data cannot be reissued.
- Treat dark web pricing as a continuous intelligence input to control prioritization and board reporting, not a once-a-year curiosity.
Further Reading
