SoK: Digging into the Digital Underworld of Stolen Data Markets

Over the past few decades, the issue of stolen data has expanded from a nuisance caused by few opportunistic individuals to a thriving, highly organised, and profitable economy. As such, it spawned a thread of research trying to document and understand the underground economy. We look back at the past 15 years of research on stolen data markets to uncover the underlying patterns and trends, documented by researchers. We examine the economy and find a changing landscape, both in terms of popular stolen data types as well as the platforms housing the marketplaces. Additionally, we record a consistent decrease in market lifespans and as well as observation periods. We highlight a number of research patterns and potential shortcomings, in particular the low coverage of markets included in research and the low diversity of languages featured in the marketplaces. Finally, we propose a number of directions for future research to better understand the true cost of the economy and the mismatch between data breaches and data appearing on markets. Future research will also need to stay on top of the changing landscape and focus on timely identification of new trends and community movements across platforms.