×

Hackers advertising stolen data on YouTube to buy

Buying stolen financial information from hackers might be easier than you think.

Contrary to the popular belief that credit card details or Netflix accounts can only be bought from the "dark web", a new report has shone a light on how hackers are advertising stolen information on services like YouTube and selling it on standard websites.

"The Hidden Data Economy" report produced by Intel Security reveals the price criminals are paying for financial information online as well as the kind of access people are able to buy.

"You don't need technical knowledge, it's dead simple you can just buy the stuff directly," Raj Samani, the chief technology officer for EMEA at Intel Security, told CNBC by phone.

When data breaches are carried out hackers will put the information online for sale. The so-called "dark web" - a heavily encrypted part of the internet that makes it difficult for authorities to detect the location or owners of a website – used to be the place to sell the data. But now, hackers are just setting up normal users where people can buy information.


Adverts on YouTube

A person will pay between $5 to $8 in the U.S. to buy a credit card that comes with the unique three-digit number on the back, an account number and expiration date, according to Intel Security. This price goes up to $30 in the European Union (EU). For a card with full information such as the name of its owner, billing address and social security number, the price is $30 in the U.S.

Hacker hacking
BrianAJackson | Getty Images

Buyers are also being given more choice about what cards they are purchasing down to the amount of available balance. The higher the balance of a card the more that a buyer will have to pay.

As well as credit cards, PayPal accounts with money in them are being sold. An account with $5,000 to $8,000 will set you back between $200 and $300.


And the whole process is becoming more professional. Sellers are using more sophisticated sales efforts and leveraging YouTube to advertise as "visual confirmation" that the person offloading the data can be trusted, the report said. Samani, one of the authors of the report, said that in all cases, firms like YouTube are notified about the issue but admits that it's difficult keeping abreast of all the videos coming online.

Google, which owns YouTube, was not available for comment at the time of publication.

The security researcher also said there were instances of sellers offering replacement policies for those cards that do not have the amount on them that was advertised.

"In many cases there are individual sellers being recommended and not recommended," Samani said, with comments being left on YouTube videos and forums about specific sellers.

Access to infrastructure

It's not just credit cards for sale. Intel Security's report points out that access to a French hydroelectric generator as well as data from a university were also up for grabs.

And video streaming services are in high demand. Netflix accounts are available, while a Hulu account could cost as little as $0.55. Accounts for streaming and on-demand service HBO NOW and HBO GO can be found for less than $10. Even loyalty accounts to hotel chains are available. Out of all the wares available online, Samani said the most concerning aspect is the amount of personal data available.

"For me it's how personalized it has become. If you wanted to, I could show you where you can buy somebody's bank login details. If you wanted to you can assume someone's identity. It's become really personal and that is a big concern," the CTO told CNBC.