Cybercriminals are selling stolen personal information on the dark web for as little as $7, according to a new report from the Better Business Bureau (BBB). The 2025 Identity Theft Scam Study reveals that people lost over $125 million to identity theft scams in 2023. Hackers are advertising batches of stolen data, including social security numbers and dates of birth, on dark web forums. One notorious scam site, BreachForums, had an estimated 14 billion pieces of stolen data before it was recently shut down.
How Scammers Use Stolen Data
Cybercriminals are using Artificial Intelligence (AI) tools to sift through vast amounts of stolen data on the dark web, quickly assembling sensitive information such as email addresses, login credentials, and biometric data. This enables them to cause more damage faster. “You can ask AI to find particularly high-value information within a set of data,” said Meredith Radford with the BBB of Eastern Carolinas. “When those are put to nefarious uses, it can help you get to people’s personal information that they can use to open bank accounts even quicker than they would be able to otherwise.”
Protecting Yourself from Identity Theft
Cybersecurity experts warn that identity theft can have serious consequences, going beyond minor inconveniences like store cards being opened in your name. To protect yourself:
- Use multi-factor authentication whenever possible
- Utilize a password manager to create strong, unique passwords
- Report any fraud attempts to law enforcement
- Minimize personal details shared on social media
“Sometimes with two-factor authentication, one of the things is asking personal questions that you select from a dropdown,” Radford warned. “People can find those answers on social media if you have that information publicly available.”
The experts stress that this is a serious issue affecting communities worldwide. “If you’re thinking ‘this could never happen to me,’ actually, it probably already did,” said cybersecurity expert Kimberly Simon. The report serves as a wake-up call for everyone to take proactive steps to protect their personal information.
