Malwarebytes 48-Hour Dark Web Dive Reveals 1,200+ Unreported Breaches and Identities for 95¢
A Malwarebytes deep-dive into dark web forums and marketplaces uncovered over 1,200 unpublicized data breaches since 2026, with stolen US identities selling for as little as 95¢ and more than 8.4 billion records exposed.
Malwarebytes researchers spent 48 hours exploring dark web forums and marketplaces to document the scale and organization of the underground criminal economy. Their findings paint a picture of a professionalized ecosystem where stolen identities, compromised databases, and hacking tools are traded like commodities, often for pocket change.
The team observed over 1,200 small and medium-sized data breaches on DarkForums alone since the start of 2026, most of which never made public headlines. On BreachForums, another 700+ compromised databases were listed in the same period. Combined, the researchers identified more than 7,500 compromised datasets containing over 8.4 billion records, including breaches at major brands such as SoundCloud, ADT, Hallmark, Amtrak, Vimeo, and Instagram.
One of the most striking findings was the price of stolen US identities. A complete 'fullz' package—including full name, Social Security Number, date of birth, and address—can be purchased for as little as 95¢. US identities are especially prized due to the country's financial infrastructure and high credit limits. The report notes that more than 1.15 million identity theft cases were reported to the FTC in the first three quarters of 2025 alone, already surpassing the total for all of 2024.
The dark web operates through a network of forums and marketplaces that function like professional networks for cybercriminals. Dominant platforms include BreachForums and DarkForums, while more exclusive Russian-language forums such as Exploit and XSS attract sophisticated actors. Link boards act as directories, helping criminals find communities in their native language. Some marketplaces are even named after public figures, including a 'Donald Trump Store' advertising stolen credit card data.
Transactions are conducted anonymously using cryptocurrency, and the ecosystem is highly organized. The researchers documented dedicated sections for leaked databases, malware, and 'scams-for-hire' services. The scale of unreported breaches means that much of the stolen personal data circulating online never appears in public breach notifications, leaving victims unaware until long after the damage is done.
The report underscores the gap between publicly known breaches and the reality of the underground data trade. While major incidents make headlines, thousands of smaller breaches quietly feed the market with fresh credentials and personal information. For individuals, the first sign of compromise often comes months or years later, when debt collectors call or a credit application is denied.
Malwarebytes emphasizes that the dark web also serves legitimate purposes, providing privacy for journalists, whistleblowers, and activists. But the criminal side is vast, organized, and growing. The findings serve as a reminder that personal data is a persistent target, and that the iceberg of data breaches is far larger than what surfaces in public reports.