What Happens After a Data Breach: How Stolen Data Is Sold and Used

A data breach notification lands in your inbox. Your email address and password — along with those of millions of other users — have been exposed. You change your password, maybe enable two-factor authentication, and move on. But the story doesn't end there. The data that was stolen has entered an ecosystem that is far more organized, efficient, and persistent than most people imagine. Understanding what actually happens to breached data helps explain why the consequences of a breach can surface months or years after the incident itself.

The breach-to-market pipeline: within hours of a major breach, the stolen data begins moving through a well-established criminal supply chain. The attackers who conducted the breach — often a sophisticated criminal group or nation-state actor — typically don't use the data themselves. Instead, they sell it. Initial sales happen on private forums and encrypted channels, where bulk datasets command premium prices. A fresh database of 10 million credentials from a major financial institution might sell for tens of thousands of dollars. As the data ages and becomes more widely distributed, prices drop dramatically.

Dark web marketplaces: the most visible part of the stolen data ecosystem is dark web marketplaces — websites accessible only through the Tor browser that operate like underground Amazon stores for stolen data. These markets sell individual credit card numbers (typically $5–$20 each), fullz (complete identity packages including name, SSN, date of birth, address, and financial account details — $15–$40 each), and bulk credential dumps (millions of username/password pairs for a few hundred dollars). Major markets like Genesis Market (seized by the FBI in 2023) and similar successors offer sophisticated search and filtering tools, customer reviews, and even money-back guarantees.

Credential stuffing: what happens to your username and password. Stolen credentials are fed into automated tools that attempt to log in to hundreds of other websites simultaneously. This is credential stuffing — exploiting the fact that most people reuse passwords across multiple accounts. A credential dump from a gaming site breach becomes an attack tool against banking sites, email providers, and e-commerce platforms. Akamai's State of the Internet report documented 193 billion credential stuffing attacks in a single year. If you use the same password on multiple sites, a breach of any one of them puts all of them at risk.

How long breached data remains active: this is the most underappreciated aspect of data breaches. Stolen data doesn't expire. A credential dump from 2018 is still being used in credential stuffing attacks today. Social Security numbers, dates of birth, and addresses — the components of identity theft — are permanent. A breach that exposed your SSN five years ago can fuel a new account fraud attempt today. This is why identity monitoring services that alert you to new account openings, credit inquiries, and dark web appearances of your information provide ongoing value long after the initial breach.

What to do when you're breached: change the exposed password immediately, and change it on every other site where you used the same password (this is the most important step). Enable two-factor authentication on the affected account and any accounts sharing that password. If financial data was exposed, place a credit freeze with all three bureaus — it's free and prevents new accounts from being opened in your name. Monitor your credit reports and financial accounts closely for the next 12 months. Consider enrolling in an identity monitoring service that watches for your information appearing in new breach dumps and dark web markets. And check HaveIBeenPwned.com regularly to see if your email addresses appear in newly discovered breaches.