Stolen Healthcare Data Exists in the Gap of High-Value PII and Lower Sentences
Brief
By Andréanne Bergeron, Security Researcher
Stolen medical records sell for $300 on the dark web. Stolen credit card numbers sell for $18. Yet the credit card thief faces an average of 55 months in federal prison, while the health data thief faces roughly 13. Cybercriminals, it turns out, are better at pricing risk than legislators are at sentencing it.
That’s the uncomfortable central finding of our study that mapped dark web PII prices against US federal sentence lengths.
This asymmetry is a signal about where sophisticated threat actors concentrate their efforts, and it has direct implications for how security teams should prioritize their defenses and threat exposure monitoring.