Welcome to the dark web – where a hacked Netflix account sells for the same price as a South African passport

Cybersecurity company NordVPN has analyzed one of the dark web markets with total illegal sales reaching R270.4 million to date – showing that South African passports are the fourth cheapest globally.

According to the group’s findings, you can buy a South African passport or ID card for as little as R156.

Among the items found globally were passports, personal IDs, driving licenses, email, payment card data, mobile phone numbers, online accounts, bank account logins, and crypto accounts as well as other personal data.

Researchers also discovered South African payment card data sold on the market for an average of R143.

“This one market is just the tip of an iceberg. There are over 30,000 websites on the dark web at the moment. Keep in mind that only 4% of the entire internet belongs to the surface web that is available to any user online,” said Adrianus Warmenhoven, a cybersecurity expert at NordVPN.

“The market that was analyzed in our case study was chosen because it was used by some big hacker groups in the past, such as the one involved in AT&T data theft in August of last year.”

The study was conducted in partnership with third-party cybersecurity researchers with an aim to warn users about the possible dangers of illegal activities people take part in on the dark web.

Average prices of found South African items and data

The most expensive merchandise overall was passports, with an average price of R10,252 per document. Czech, Slovakian or Lithuanian passports were the costliest (avg. price R59,386), while South African passports were the fourth cheapest.

“The price depends on many factors, including how difficult it is to fake a document, how widely it is sold, how commonly it is bought, and the checks and balances in place in a particular country that prevent fraud,” said NordVPN.

Similarly to other countries, South African data that could be brute-forced or guessed is sold at lower prices. Payment card data costs around R143. Another easy way for hackers to steal a user’s data or digital asset is credential stuffing (when the leaked password or email is used to get access to other platforms).

That is why online accounts come at a low price: a hacked Netflix account can be bought for R151, an Uber account for R187, and a Twitter account for as little as R31.

Crypto wallets and investment accounts cost more than payment processing accounts and even more than some of the bank accounts, noted NordVPN. With an average price of R6,158, the most expensive crypto account data is from Binance, followed by Kraken (R6,001) and Crypto.com (R5,470). Payment processing accounts (e.g., PayPal) have an average price of R1,558.

The most expensive merchandise in this category is the CashApp account, costing around R3.805.

NordVPN said that some criminals also buy emails in batches and use them for phishing attacks or other malicious purposes. Researchers noticed that those emails could be put in three types: personal emails, business emails, and voters’ emails.

Read: Offices in South Africa are facing a new work from home headache