How stolen data is sold: forums, markets, channels and leak databases

How stolen data is sold: four kinds of venue

Stolen data reaches buyers through four kinds of venue. Forums host listings for breached databases and broker the deals. Markets and shops sell access per infected device or per account. Messaging channels, Telegram among them, distribute and sell data in bulk with a low barrier to entry. Leak databases index billions of breached records and sell searches across them.

The European Commission's summary of Europol's 2025 Internet Organised Crime Threat Assessment states: "Access credentials to remote services, compromised corporate networks, and personal logins are sold in bulk."

This guide describes each venue from law enforcement announcements, court records and published threat research. It explains how the trade is organized, not how to take part in it. EDG3, WebThreat's threat intelligence for leaked data, watches these venues for your domain. For the sellers themselves and the traces a company's data leaves, see who trades stolen company data.

Forums: listings, credits and middlemen

Forums are where breached databases are announced, discussed and sold. RaidForums is a well-documented example. According to the Department of Justice announcement of April 12, 2022, RaidForums served from about 2016 through February 2022 as "a major online marketplace for individuals to buy and sell hacked or stolen databases". Members offered "hundreds of databases of stolen data containing more than 10 billion unique records".

The same announcement describes the mechanics:

• a subforum called "Leaks Market", which described itself as a place to buy, sell and trade databases and leaks;
• membership tiers at escalating prices, up to a top tier called "God";
• "credits" that let members unlock and download stolen data;
• a fee-based "Official Middleman" service, in which the administrator acted as a trusted intermediary so buyers and sellers could check the payment and the files before a deal closed.

When RaidForums was shut down, a replacement followed. The Justice Department's release of September 16, 2025 on the resentencing of the BreachForums founder states that BreachForums launched in March 2022 and grew to over 330,000 members. It "maintained and offered access to at least 888 datasets of stolen information containing over 14 billion individual records of PII". The Fourth Circuit's January 2025 opinion in the case records that FBI agents working undercover bought the birth dates, Social Security numbers and bank account information of around 15 million Americans on the site for approximately $5,000.

Middlemen are common across these venues. Kaspersky studied dark web posts about escrow from January 2020 through December 2022 and counted more than one million messages mentioning an escrow agent, almost 313,000 of them in 2022. Its researchers write that escrow services "control the fulfillment of agreements and reduce the risks of fraud in nearly every type of deal", and that site administrators punish cheaters by blocking or banning them or adding them to fraudster lists.

Markets and shops: access sold per device

Some venues sell stolen access instead of whole databases. Genesis Market is a well-documented case. When the U.S. Treasury sanctioned it on April 5, 2023, alongside a coordinated international law enforcement operation, Treasury said the site compiled stolen victim data "from malware-infected systems around the globe and packages it for sale". As of February 1, 2023, about 460,000 packages were listed, "each of which represents a single, compromised victim computer or device". Treasury also reported that a U.S. company was breached in June 2021 because of a cookie bought on Genesis Market.

That supply comes from infostealers. Microsoft Threat Intelligence describes Lumma Stealer as a malware as a service offering that "extracts saved passwords, session cookies, and autofill data" from common browsers. In a disruption announced on May 21, 2025, Microsoft's Digital Crimes Unit facilitated the takedown, suspension and blocking of about 2,300 domains used by Lumma's infrastructure. The output of an infection is a stealer log, which is then sold, shared or folded into larger lists.

Large darknet markets carry stolen data next to other contraband. Treasury's April 5, 2022 sanction of Hydra Market listed "stolen personal information" among its offerings, next to ransomware as a service, hacking services and drugs, and put the market's revenue at over $1.3 billion in 2020.

Initial access brokers sell a different product: a way into a company network. Microsoft's 2022 analysis of ransomware as a service explains that some access brokers infect systems and sell them as a "load", while others compromise exposed or unpatched systems en masse to "bank" for later profit. Some advertisements point out that a system has no antivirus or EDR product and comes with a Domain Administrator credential, "to fetch higher prices".

Channels: Telegram and other messaging apps

Messaging channels lowered the barrier to entry. Kaspersky Digital Footprint Intelligence reported on July 1, 2024 that cybercriminal channels and groups on Telegram distribute leaked databases and trade criminal services, and that the volume of such posts rose 53% in May and June 2024 compared with the same period a year earlier. The same release notes that Telegram lacks the reputation systems found on dark web forums, so many scammers operate there.

The scale shows in data that reached Have I Been Pwned. In June 2024 Troy Hunt loaded a set scraped from Telegram: 1,748 files from 518 channels, about 2 billion lines and 361 million unique email addresses, 151 million of them never seen in the service before. Many rows paired the password with the website it was used on, which Hunt describes as looking very much like infostealer output.

Channels are short-lived, and sellers move. Kaspersky's December 2025 study of more than 800 blocked Telegram channels found that the median lifespan of a shadow channel rose from five months in 2021 to 2022 to nine months in 2023 to 2024. Blocking has increased since October 2024, and cybercriminals have been migrating to other messaging services. Europol's 2025 assessment, as summarized by eucrim, found that end-to-end encrypted apps are increasingly used "to negotiate and conduct sales transactions involving breached data", and that sellers spread their activity across several platforms to make it more resilient against law enforcement. Our own research followed the same movement: after the January 2025 seizure of Nulled.to and Cracked.io, stolen-data trading shifted to Telegram "clouds", channels that package stolen data and resell it in bulk.

Leak databases: searches sold by subscription

A leak database indexes breached records so they can be searched. Criminal versions sell the search. The UK National Crime Agency announced on January 17, 2020 that weleakinfo.com, believed to host credentials from around 10,000 data breaches, had been taken down. It provided access to more than 12 billion personal credentials "for as little as $2 per day", and the NCA said the credentials had been used in further cyber attacks in the UK, Germany and the US. Officers believed the two suspects had made total profits of more than £200,000.

Lookup services also feed new lists. Troy Hunt's January 2024 analysis of the Naz.API list, 104GB of stealer logs and credential stuffing pairs posted to a hacking forum, reports that the data was apparently sourced from a now defunct website that provided search results for other people's data.

Legitimate breach notification services index many of the same breaches so that people can check their own exposure. Once data has been posted in one place, expect it to be indexed in others.

Why the same data is sold more than once

Data does not leave the market after its first sale. It is reposted, merged into new lists and offered again under new names. Hunt's 2019 write-up of Collection #1 describes a forum post advertising "a collection of 2000+ dehashed databases and Combos stored by topic", which added up to almost 2.7 billion rows. The article on what a combolist is follows that cycle.

Old data still works. In the 2024 campaign against Snowflake customer instances, Mandiant found that the majority of the credentials the attacker used came from historical infostealer infections, "some of which dated as far back as 2020", and that in many cases the credentials had not been rotated for as long as four years. The attacker then extorted victims and attempted "to sell the stolen customer data on recognized cybercriminal forums". Mandiant also notes that large lists of stolen credentials "exist both for free and for purchase inside and outside of the dark web".

What the venue tells a security team

Where the data appears says a lot about what kind of exposure a company has.

• A database listing on a forum points to a breach at a specific service. The risk depends on which fields were taken and where the passwords were reused.
• A device package or stealer log points to an infected computer. Sessions are at risk as well as passwords, so the response includes revoking sessions and cleaning the device. See combolists vs stealer logs vs database dumps.
• A combolist entry points to a credential in circulation. The first question is whether that password is still in use.
• A hit in a leak database means the data is indexed and searchable, often long after the original breach.

EDG3 is WebThreat's threat intelligence for leaked data. It watches the channels and communities where stolen data, stealer logs and combolists are posted and sold, including dark web forums and marketplaces, Telegram and other channels, and leak databases. For a domain whose owner has authorized it, EDG3 traces a leak back to its first post and the seller behind it, links reposted copies of the same data and keeps the provenance of each. If the question is which of your executives appear in breach data, CEM checks them against breach corpora and leak databases and ranks the findings by what to fix first, using the factors set out in the methodology.