Combined PII is Worth Thousands of Times More Than its Parts: Stolen Data Math
Brief
By Andréanne Bergeron, Security Researcher
You type in your email address for a 10% discount. You share your phone number to verify an account. You enter your name on a sign-up form. Each disclosure feels trivial because, in isolation, it is: an email address costs $0. 0002 on the dark web, and a name costs about the same. Pair them together in a breach, and the price doesn’t double, it explodes.
New research across 318 breaches reveals that stolen data bundles are systematically worth more than the sum of their parts.
Key Takeaways About the Value of Combining PII
- Personal data value is superadditive, meaning combined data is worth far more than the sum of its parts. 52% of multi-PII breaches sell for more than the additive sum of individual PII prices, even under conservative measurement.