Australians’ stolen data can sell for less than the cost of lunch. Analysis by NordVPN and NordStellar of roughly 75,000 dark web listings found an Australian payment card has a median price of $10, Disney Plus account details fetch about $7.25, and a “fullz” identity package can cost around $200.
The figures matter because they show how cheaply criminals can assemble the ingredients for fraud. According to the ACCC’s Target Scams Report 2025, Australians lost more than $2.18 billion to scams last year, with phishing scams alone accounting for $97.6 million.
Why low prices still signal high risk
A low sale price does not mean the harm is minor. In criminal markets, stolen data is often cheap because supply is abundant: major breaches, phishing campaigns and credential theft tools can produce vast volumes of account details and personal records. That abundance pushes prices down while making fraud easier to scale.
The “fullz” packages highlighted in the analysis are especially concerning because they combine multiple pieces of identifying information in one purchase. Details such as a tax file number, date of birth and address can be enough to support tax fraud, account takeovers or the construction of a false identity. As NordVPN chief technology officer Marijus Briedis put it, a criminal can spend less than a weekly grocery shop to buy enough information to begin impersonating someone else.
Why crypto accounts command more money
The analysis found Kraken account details listed at $150, making crypto accounts among the more valuable targets. The reason is straightforward: unlike payment card fraud, which often involves extra steps and can trigger bank monitoring, a compromised crypto account may give an attacker rapid access to funds if protections are weak.
That does not mean traditional financial data is safe to dismiss. Even a low-cost card listing can be useful when paired with other stolen details, especially if criminals are attempting account verification, social engineering or broader identity fraud. The dark web economy works through combination as much as through single high-value records.
How Australians can respond after exposure
For most people, the first challenge is knowing whether their details are already circulating. NordVPN points users to its Dark Web Monitor, while the free service Have I Been Pwned can help people check whether email addresses have appeared in known data breaches. Discovery does not erase the risk, but it gives people a chance to change passwords, review account recovery settings and watch for unusual activity.
Georgia Dixon, former managing editor of SafeWise Australia, said there is only so much individuals can do to stop their data appearing on the dark web in the first place. The practical steps remain familiar because they still matter: use strong, unique passwords, turn on multi-factor authentication, avoid entering sensitive information unless necessary, stick to secure internet connections and regularly review bank and other financial accounts for suspicious transactions.
The broader lesson for digital safety
The pricing data is a reminder that personal information has become a routine commodity in criminal marketplaces. When identity details, streaming logins and financial credentials are all traded at modest prices, the barrier to entry for fraud drops. That has consequences beyond individual victims, adding pressure to banks, telecommunications providers, digital platforms and public agencies that must detect abuse and limit the damage after breaches occur.
Australians on the Telstra network, including MVNO customers, also have access to Telstra Scam Protect alerts for suspicious incoming calls, a measure aimed at one common route into phishing and impersonation scams. Tools like that can help at the margins, but the larger picture is harder to ignore: once data is exposed, it can circulate widely, be resold repeatedly and be combined in ways that make small pieces of information far more dangerous than they first appear.