How Stolen Data Moves After a Breach

A breach is an event. A dark-web listing is a product. Between the two sits a short supply chain: someone steals a pile of records, someone else formats them, a broker advertises access, and a buyer runs the passwords against every other site on the internet. Most of the rows in a "1 billion password" dump are recycled. That does not make them harmless. It makes them cheap.

This page maps the chain. The glossary of payment-card slang is carding terminology. What you can actually do as a person is the check-and-rotate walkthrough.

Intrusion and stealers

Two common sources fill the pipeline.

Corporate breaches. A ransomware affiliate, a misconfigured bucket, or an employee stealer on a helpdesk PC dumps a customer table: emails, password hashes, sometimes government IDs, sometimes card tokens. The crew may publish it on a leak blog if the ransom fails, or sell it quietly.

Infostealers. Malware on a home or office computer exports browser cookies, saved passwords, autofill and session tokens. Those "logs" are sold by the piece or in bulk. Verizon's DBIR editions through 2024–2025 kept repeating the same finding in different wording: stolen credentials sit behind a large share of web-application breaches, and stuffing remains cheap because people reuse passwords.

The first seller is often not the person who will extort the bank. They want volume and a fast crypto payment.

Packaging: combolists, logs, and "full" records

Forum culture sorts the raw steal into SKUs:

Combolists — email:password lines, often deduplicated from many old breaches. Useful for stuffing. Low price, low freshness.
Stealer logs — a folder per infected machine. Higher value if the cookies are still live.
Database dumps — SQL or CSV from a named company. Value tracks how recent and how sensitive (health, tax, government).
Payment cards and identity packs — closer to the carding trade; often sold on specialized shops rather than a general leak forum.

Prices move. Public reporting from intelligence vendors (Flashpoint, KELA, Recorded Future and others) has put a single fresh stealer log in the single-digit to low-double-digit dollar range for years, with corporate-admin cookies priced higher. Treat any screenshot of a price list as a moment in time, not a tariff.

Most listings are copies of copies. A 2012 breach still circulates in 2026 with a new filename. Buyers who do not check dates pay for noise. Buyers who do check dates still get a usable overlap: the password you have not changed.

Brokers and forums

The storefronts have names that keep dying and returning — the RaidForums / BreachForums line is the public example. Access brokers sit next door: they sell a VPN session into a company, not a CSV of its customers. Ransomware panels buy that access; so do quieter fraud crews.

Reputation systems on those forums are as reliable as any anonymous marketplace: useful until the admin exits or the whole board is seized. After a seizure, the member database becomes an exhibit. That is one of the quieter risks of "just lurking."

Search engines on the clearnet that claim to "scan the dark web for your email" are usually reading the same public breach collections Have I Been Pwned and similar services already ingested. They are not browsing fresh onion shops in real time. The check guide is honest about that limit.

Resale and use

Once a combo is for sale, the uses fork:

Credential stuffing. Automated login against Netflix, banking, mail, corporate SSO. Verizon and others have reported stuffing as a dominant pattern in basic web attacks; unique-password rates in leaked sets stay low.
Session hijack. A live cookie from a stealer skips the password and the MFA prompt until the cookie dies.
Phishing with context. "We already have your old password" mail is more convincing than a generic invoice.
Account takeover and mule networks. The scam-pattern page covers the fraud side; this page is the feedstock.
Initial access. A reused work password becomes a ransomware event. See how those gangs are organized.

The victim does not see "the dark web." They see a locked mail account or a card alert, weeks or years after the original incident.

What it means if you are in a dump

You cannot delete the copy. You can make the copy useless for stuffing: unique passwords, a password manager, MFA that is not SMS if you can help it, and a look at whether a session might already be open. Credit monitoring and freezes address the identity-pack branch, not the Netflix-password branch.

Companies have a different job: figure out whether the dump is theirs, whether hashes are unsalted, and whether the law requires notice. Paying a "takedown" firm to remove a forum thread buys you a dead link and a re-upload.

Frequently Asked Questions

Is every huge password dump new?

No. Many are concatenations of old breaches. The new damage is the overlap with passwords still in use and the convenience of a single file for stuffers.

Do dark-web "removal" services work?

They cannot recall files that have been copied. At best they get one listing taken down. At worst they are a second scam. Do not buy your own data back.

What is an infostealer log?

A package of data pulled from an infected computer: browsers, cookies, sometimes files. It is more dangerous than an old combolist while the sessions are live, and it is sold in bulk.

How does this connect to ransomware?

Stolen VPN or Office credentials, or a brokered RDP session, are how affiliates get in. The customer database that later appears on a leak site is a different product from the same industry.