A sound and thoughtful data security strategy can make a difference in a business environment because it helps organizations protect one of their most valuable assets—data—against cyberattacks.

Why is enterprise data security important?

In the digital age, data reigns supreme. These days, all businesses deal with data in one way or another. Whether it’s a financial institution handling sensitive customer data or an individual operation collecting the contact information of its clientele, data is a significant part of all enterprises, regardless of their size or industry. Data informs decision-making, improves efficiency, enables better customer service, and plays a major role in marketing.

With growing public awareness about the importance of data security and more data-related laws and regulations coming into play, companies face challenges in creating secure infrastructures and processes to handle enormous amounts of data.

Data security software management strategies are simple to establish, for instance, by conducting digital safety training or enforcing centralized password policies. Setting up an enterprise password manager can be a massive upgrade to an organization’s security practices. Although high-end software can greatly improve an organization’s security strategy, employee awareness is often what makes or breaks its effectiveness.

Failure to establish a secure perimeter frequently results in a data breach, leading to substantial regulatory fines and reputational damage. According to IBM’s Cost of Data Breach Report 2023, the global average data breach cost is estimated at $4.45 million. It’s not hard to imagine that a data breach could spell the end of a company.

As data breaches and cybercrime continue to rise and become more sophisticated, companies of all sizes and industries look for ways to ensure the security of their data. And the first step in doing so is understanding the threats you’re facing.

What threats to data security do companies face?

Cyber threats that can compromise data security in businesses come in various shapes. Here are some of the most common data security risks that every organization has to deal with.

• Phishing attacks

Phishing attacks are designed to acquire sensitive information from unsuspecting users. Hackers achieve their goal by crafting email messages that appear to be from a reputable source. In those messages, you are usually urged to download a malicious attachment or click on a dodgy link. If you follow through, the attackers can access your device and get their hands on your sensitive data.

• Accidental data exposure

Not all data breaches are caused by cyberattacks. Sometimes, they’re byproducts of human error or lack of awareness. In day-to-day office life, employees will inevitably share data and exchange access credentials. Unfortunately, security might not be at the top of their priority list, and accidents can happen: data can end up on an unsecured server, and passwords can be stored in a publicly accessible sheet. That’s why cybersecurity training sessions are critical. Once employees grasp what’s at stake and what to pay attention to, the risk of accidental data exposure can be drastically minimized.

• Malware

Malware is usually spread via email. In most instances, hackers launch a phishing campaign to trick users into downloading and installing malicious software. Once malware is on a corporate network, hackers can do pretty much anything, from tracking network activity to downloading enormous amounts of data without authorization.

• Ransomware

Ransomware is a type of malware that is designed to encrypt data on the affected machine. If a ransomware attack is successful, bad actors will demand a ransom in return for decryption services.

• Insider threats

Insider threats might be the hardest to anticipate. As you can guess, insider threats are employees who intentionally harm an organization’s security perimeter. They might share sensitive data such as passwords with dubious third parties or steal business data and sell it on the black market.

What types of data security are we talking about here?

As already discussed, data security protection strategies comprise many different tools and practices. Typically, the most effective way to ensure data security is to use a combination of security practices to limit the potential surface area of an attack.

Data encryption

Data encryption is one of the easiest ways to ensure the security of sensitive information. Fancy terminology aside, data encryption converts readable data into an unreadable encoded format. Think of it this way: even if a hacker were to get their hands on the encrypted data in your servers, they couldn’t do anything unless they managed to decrypt it. Fortunately, contemporary encryption is unbelievably hard to crack without a decryption key.

Data erasure

As time passes, collected data can become irrelevant. It can clog your servers like clutter in your attic. Security-wise, irrelevant data is rarely considered a priority, and sometimes, it’s best to just get rid of it for good. Data erasure is an effective data management and security method because it shrinks the potential attack surface and liability in case of a data breach.

Data masking

Data masking is a data security technique during which a data set is duplicated, but its sensitive data is obfuscated. The benign copy is usually used for testing and training for cybersecurity purposes. Masked data is useless for a hacker because it is essentially incoherent unless the hacker knows how that data has been obfuscated.

Data resiliency

Data backups are among the easiest steps an organization can take to mitigate the potential dangers of data loss in a cyber event. Backups ensure that even if data is compromised or stolen, it can be recovered to its previous state rather than entirely disappear.

Data security vs. data privacy: What’s the difference?

Today, the terms “data security” and “data privacy” are often used interchangeably. While, in a general sense, that can be true, they’re technically distinct concepts.

Data security is a broad term that encompasses data privacy. However, when we talk about data security, we mainly refer to cybersecurity practices aimed at protecting data from unauthorized access or corruption.

Data privacy, on the other hand, is a concept that aims to ensure the way businesses collect, store, and use data is compliant with legal regulations.

How about data security vs. cybersecurity?

Similarly, you might have some questions about the difference between the terms “data security” and “cybersecurity.” The difference here is the scope of what each security type covers.

Broadly speaking, cybersecurity concerns things on the macro level: protecting servers and networks from cyberattacks as the first line of defense. Data security, on the other hand, protects the micro: the actual data stored within the networks. If cybersecurity measures fail, data security aims to keep valuable information unaffected using encryption and other measures we’ve discussed.

How does data security compliance work?

Today, most countries have laws and regulations that govern the way organizations should collect, store, and use data. Regulatory compliance can be a challenge for companies of all sizes and industries. Still, they’re vital in ensuring that your data will not be abused and remain secure at all times. Here are some of the most important regulations that relate to data security.

General Data Protection Regulation (GDPR)

The GDPR is the European Union’s primary data protection and privacy legislation. Passed in 2016 and implemented in 2018, it ensures organizations handle consumer data responsibly and securely. The GDPR was one of the first legislative efforts requiring companies to ask for user consent to collect their data.

The GDPR is expanded legislation, and failure to comply can lead to penalties of up to €20 million, or 4% of a company’s annual global turnover. Thus, choosing reliable tools that help work toward compliance with GDPR, like NordPass, to manage and secure customer data, is crucial for ensuring overall enterprise security.

California Consumer Privacy Act (CCPA)

The CCPA went into effect on January 1, 2020. It provides consumers in California with additional rights and protections regarding how businesses use their personal information. The CCPA is very similar to the GDPR and imposes many of the same obligations on businesses that the GDPR does, except for the implementation of robust security measures to protect customers’ personal information from unauthorized access, destruction, modification, or disclosure.

Health Insurance Portability and Accountability Act (HIPAA)

HIPAA is the United States data protection and security legislation that regulates electronically protected health information (ePHI). It is aimed mainly at healthcare providers and partnering institutions that deal with such data. HIPAA lays out requirements for the security of ePHI, which involves specific physical, technological, and administrative safeguards. To stay compliant with HIPAA regulations, medical companies should implement some security measures: safe traffic encryption with a VPN, secure messaging apps, encrypted email services, and reliable business password management.

Sarbanes-Oxley (SOX) Act

The SOX Act was passed in 2002 to protect shareholders and the general public from fraudulent corporate practices and to improve the accuracy of corporate disclosures. Although the act does not specify how an organization should store records, it does define which documents should be stored and for how long. The SOX Act primarily applies to public corporations.

Payment Card Industry Data Security Standard (PCI DSS)

The PCI DSS is a set of regulations geared toward organizations that process, store, and transmit credit card data. It lays out requirements to ensure that all credit card-related data is handled securely.

International Standards Organization (ISO) 27001

ISO/IEC 27001 is an Information security management standard that outlines how business entities should manage risk related to cybersecurity threats. The ISO 27001 standard is used to define data security guidelines and requirements intended to protect an organization’s data assets from unauthorized access or loss. The ISO/IEC 27001 is not legislation in the sense that the GDPR is. It is rather a standard that helps businesses comply with regulations such as the GDPR cost-effectively.

Data security best practices

Data security is a complex concept that includes a variety of practices and processes working together like a well-oiled machine. The data security strategy within the organization depends on its size, IT infrastructure, resources, and several other variables. However, a few data security technologies and solutions can be applied in any organization.

Access management and controls

Access management and controls help organizations set rules for who has access to networks, systems, files, and various accounts within the digital ecosystem. Proper access management and control integration can significantly shrink the potential attack surface area.

Employee education

One of the leading causes of data breaches is human error. The obvious counter is education. For an organization that wishes to be successful security-wise, a team that is aware of the risks that might be faced and how they would be handled is crucial.

Password management

Weak, reused, or old passwords also play a significant role in data breaches. It’s understandable because today, an average person needs about 170 passwords, leading to a reliance on the same easy-to-remember passwords for multiple accounts. Ensuring that each one is unique and complex is impossible without help from technology. Password managers are tools designed to help individuals and organizations create strong passwords, securely store them, and access them whenever there’s a need. Today’s business password managers improve organizational security as a whole and spur productivity with handy features such as autofill and autosave.

Cloud data security

Many organizations rely on cloud technologies to carry out daily operations. While cloud technology offers significant benefits, it simultaneously opens up additional security risks. Misconfigured cloud technology services can lead to data leaks and breaches. Therefore, you must take action to ensure that any cloud apps you use are properly configured to limit potential risks and prepare a robust cloud security strategy for your company.

Data encryption

As discussed earlier, data encryption is a way to secure information within databases and servers by making it unreadable without the decryption key. Encryption is essential to overall data security and should always be employed.

Data loss prevention and backups

These days, most business-related information is stored in databases. The data they contain may be customer records, credit card details, or internal company documents. Backing up data protects the organization from accidental data loss or corruption. Regularly scheduled backups can also help in the case of a ransomware attack since they can be used to restore the affected data.

Incident response and disaster recovery plans

An incident response plan is an organization’s systemic approach to managing a security-related event. Usually, such plans are purpose-built to address malware attacks, data breaches, unauthorized network intrusions, and other cybersecurity-related events. With a comprehensive incident response plan, the organization has a clear pathway to mitigating a cyber attack in a swift and coordinated manner.

A disaster recovery plan (DRP) is focused on broader business continuity and recovery efforts in the face of major disasters: natural catastrophes, power outages, or system failures. DRP encompasses a more extensive range of scenarios than IRP, often including data backup and redundancy, a proactive cybersecurity approach, alternate work locations, and comprehensive recovery procedures.

Multi-factor authentication (MFA)

Multi-factor authentication is a method that requires two or more authentication factors such as additional passwords, PINs, passphrases, tokens, geographical locations, or biometric data. In the business world, multi-factor authentication provides the highest level of security required by GDPR or HIPAA regulations. MFA works like a safety net and can save an organization a lot of trouble and money if login credentials to corporate accounts are breached. In most cases, cyber crooks are not able to obtain extra authentication factors.

It seems only reasonable to ask for extra proof of identity online. However, many individuals and companies rely solely on one layer of security. The reason may be a common misconception that MFA is difficult to adopt, especially in a corporate environment where it has to be incorporated into the existing IT infrastructure. In reality, advanced password management tools like NordPass can smooth the whole process and make the adoption of multi-layered security easy like a piece of cake.

Email security

For many, emails are their main work tool. No wonder so many corporate secrets get into the wrong hands through carefully crafted phishing emails. Cybercrooks bend over backward to make their fraudulent attempts look legit. Luckily, some measures enhance company email security.

First of all, well-trained employees who are aware of various types of cybercrime are less likely to risk the company’s safety by clicking random links or acting in haste. Second, corporate-wide solutions like multi-factor authentication, encrypted VPN, or email masking create further layers of security, contributing to the overall safety of an organization. Finally, the random and complex passwords stored in an encrypted vault are the solid foundation of email security and should never be underestimated.

The Future of Data Protection

Technological developments like AI-powered tools create new opportunities for cybercriminals to compromise data security and obtain highly valued sensitive information. Businesses need to think fast to prepare themselves for emerging threats and keep a close eye on their data security systems to ensure they don’t leave any room for cybercrooks to interfere.

AI enhancements. What’s the best way to fight AI-powered fraud tools? AI-powered security tools. AI can enhance data security systems by speeding up threat response times and providing more sophisticated analysis of your organization’s threat landscape. AI tools can also provide live monitoring of data security systems.

Multicloud security. While cloud security has become somewhat of a norm for businesses, developments in quantum computing pose risks that it may not be sufficient in the future. Multicloud security provides broader support for data protection. Companies use tools from different cloud solution providers to decentralize access to sensitive information and increase their overall security.

Quantum security. Although quantum cybersecurity is still in the conceptual stage, its practical use is already being discussed by tech experts. Quantum computing has the potential to provide new kinds of complex encryption for sensitive data that could not be bypassed by non-quantum means.

How NordPass Business can help

As mentioned, weak, old, or reused passwords are often the cause of a data breach. Password fatigue is a major factor that leads people to use weak and easy-to-remember passwords across multiple accounts. However, password fatigue can be mitigated with the help of a corporate password manager.

NordPass Business is purpose-built to improve organizational security and take a load off employees when creating and remembering passwords. Keep all your business passwords, credit cards, and other sensitive information in a single encrypted vault and securely access it whenever you need. Thanks to company-wide settings present in NordPass Business, you can set password policies across your organization. And with the help of the Admin Panel, access management is easier than ever.

NordPass Business is ISO/IEC 27001:2017 certified and has received the SOC 2 Type 2 attestation, making it a critical security tool for companies striving to meet GDPR and HIPAA compliance standards.

Try NordPass Business with the 14-day free trial and enjoy improved productivity and security within your organization.

Organized crime is no longer out on the streets—it has seeped into the very fiber cables that keep the internet running, creating new hybrid and wholly virtual threats that require unprecedented strategies to tackle. In March, Europol published the 2025 EU Serious and Organized Crime Threat Assessment, or the EU-SOCTA. It revealed that the DNA of organized crime has been undergoing serious shifts, posing threats that may be more dangerous and destabilizing than ever before.

EU-SOCTA 2025 at a glance

The EU-SOCTA is a report issued by Europol every 4 years that assesses serious and organized crime activities in the EU and the evolution of criminal tendencies and practices. It serves as the foundation for the EU’s strategic approach toward tackling serious and organized crime.

The data is extracted from Europol’s investigations and contributions from other law enforcement partners around the globe. The EU-SOCTA helps decision-makers, whether at the governmental, business, or individual level, to set priorities and to effectively prepare for and combat serious threats.

Europol is the EU’s law enforcement agency, focusing on combating serious international crime and terrorism in all Member States. It collaborates with other EU agencies and international partners to strengthen global security cooperation and share intelligence on ongoing threats.

For the 2025 assessment, Europol gathered data from thousands of law enforcement investigations and used the expertise of EU agencies and international organizations to create the most comprehensive analysis of serious and organized crime to date.

Destabilizing the Union

The 2025 EU-SOCTA makes it clear—as the world evolves, so does the DNA of organized and serious crime. The online space has become its new home and facilitator, as criminals increasingly rely on the internet to conduct their activities.

Switching their primary headquarters to the digital world—spaces like the dark web, social media platforms, and e-commerce sites—allows criminals to utilize digital tools for more malicious attacks. Developments in the tech world facilitate speedier execution on a larger scale and make it harder to track down perpetrators, particularly those relying on decentralized blockchain systems.

The report names the destabilization of the EU as one of the biggest threats posed by serious and organized crime. Criminal organizations aim to reduce trust in the legal system and government through the spreading of violence, illicit proceeds, and corruption. They rely on digital innovations like AI to conceal their activities and make it harder to trace crime back to its source.

The offender profile: younger and more violent than before

As the way the crimes are committed shifts, so does the profile of the criminal. As the 2025-SOCTA reveals, the criminals are becoming younger, more tech-savvy, and more brutal than before. In an interview with NordPass in 2024, Adrianus Warmenhoven mentioned that people working for cybercriminals may not know the nature of their work, instead assuming they’re hired as IT consultants.

The report notes the exploitation of younger perpetrators to conduct illegal trade and commit crimes for a reward. Young recruits—including minors—are preferred as they’re more willing to conduct illicit activities without financial reward. Blackmail is often used to maintain this working relationship.

Criminals use end-to-end communication services to plan and execute their attacks. Encrypted channels make it harder to intercept communication and offer anonymity, IP obfuscation, rotating IDs, or automatic message deletion after a set period of time.

One aspect remains largely unchanged: financial interest. Criminal networks use illicit means to fund their operations, whether via corruption or money laundering. Some may be working for hire, receiving funding from larger organizations to disrupt society and conduct their activities.

Part of the shift is relying less on legal tender and more on cryptocurrencies to funnel illicit funds. Cybercriminals use blockchain technology to transfer the money as crypto, making it harder for investigators to track down or recover. Crypto technology has also been combined with malware to bolster cryptojacking, a type of attack where a device is infected and hijacked to be used as a crypto mining machine.

Threat actors tend to start with smaller misdemeanors, building up the damage over time, leading to the so-called woodpecker effect. By acting small at first, they make it harder to see the bigger picture and prevent illicit actions in the early stages of organized attacks.

As these acts grow in scale, so does the use of violence. The report notes that violence related to organized crime has spilled over into public places, with a new service model emerging. Violence-as-a-service sees actors working with state agents or criminal organizations to promote and provoke violence in EU Member States and outside their borders. It involves both physical and digital activities, such as extortion, blackmail, and psychological violence.

Hybridizing crime: the online spills into the offline

The report’s title, “The changing DNA of serious and organized crime,” hints at the big shift over the years as new types of hybrid threats emerge, mixing a variety of criminal activities to maximize profits and success rates.

Europol notes a close link between the increasingly hybrid nature of serious and organized crime and recent geopolitical tensions. The intersection of online and offline criminal activities, technological advancements, and the role of state and ideological actors in these crimes create more dangerous threats and unprecedented challenges.

For criminals, each technological development is a new opportunity to increase their toolkit and create new, unpredictable threats. The internet has done a massive service to cybercriminals, who now rely on the dark web or decentralized blockchain networks to obfuscate their activities, infiltrate their targets, and participate in illegal data trades.

Some serious crimes aren’t even conducted offline anymore—every step, from the initial idea to its execution, is 100% online. In fact, Europol notes that nearly all forms of serious and organized crime have a digital footprint.

Through hybridization, criminal networks act more as proxies on behalf of other organizations or even hostile states to destabilize the EU and weaken its economy. The report lists fraud, child sexual exploitation, migrant smuggling, cyberattacks, waste crime, and trafficking of illicit goods and weapons as some of the key activities facilitated by hybrid threat actors.

Cybercrime expertise has become a requirement. Ransomware attacks have proven to be profitable, targeting high-profile businesses or government agencies. Such attacks can impact essential services, particularly those in the public sector, further sowing distrust in institutions.

The (continuous) emergence of artificial intelligence

As with seemingly all things tech lately, AI is the name of the cybercrime game. Europol lists AI developments and quantum computing among the potential accelerators for serious and organized crime, particularly given the rapid developments in these fields.

Despite their relative novelty, AI systems like large language models (LLM) and generative AI have already been put to practical use by criminal networks. Through AI tools, criminals can improve their efficiency, act more seamlessly, and perform operations that are harder to prevent or combat.

Generative AI, in particular, has been helpful thanks to its low entry level. Any criminal can put in a prompt to create a script in their chosen language, which can then be used for spoofing, creating deepfake materials, or otherwise facilitating illicit activities. AI-powered voice notes and video materials pose a high risk of identity theft.

AI has also broadened the scope of attacks even further. Although online attacks were already far-reaching, AI requires fewer resources than previously observed. Some cybercriminals have been utilizing AI to brute-force more complex passwords, making credentials that were previously considered relatively resistant to threats vulnerable.

Although quantum computing is still relatively theoretical, criminals already operate with the anticipation of its eventual practical application. Access to quantum computing may pave the way for more efficient and sophisticated decryption technology, which would make data currently protected by encryption algorithms easier to breach.

The timeliness of AI is both its advantage and its downside for criminals. Its applicability is still relatively limited, and if illicit AI use increases, developers will likely implement preventative measures. Legislation will catch up, too, as legal entities are already starting to implement policies that regulate AI usage.

For-profit cybercrime flourishes

Europol notes the emergence of crime-as-a-service, where criminals act as corruption brokers and use digital tools for profit-driven operations. Corruption remains one of the biggest threats to businesses and government institutions, “embedded in the very DNA of crime.” Due to its massive impact on economic systems, corruption is interspersed in practically every form of serious and organized crime.

Criminals rely heavily on money laundering to procure funds. The infiltration of legitimate funds for money laundering is high-risk, high-reward. Transactions require an intricate system of hard-to-trace financial systems. However, the biggest operations can generate as much as billions of euros, making them an intrinsic part of serious and organized crime.

Crime-as-a-service is favored by state actors. It can help sanctioned states circumvent financial embargoes. In exchange for illicit services, criminals may receive a safe haven in the state that hired them. Criminals—particularly those working fully online—receive access to resources funded by the state to conduct disinformation campaigns or supply chain disruptions. This grants state actors plausible deniability, as attacks are conducted by proxy, and the state’s involvement may be too obscure to be proven.

Social media accounts have also been broadly utilized for serious and organized crime, especially on political grounds. Criminals may create fake social media accounts—often referred to as troll farms—to spread misinformation or propaganda, manipulate the newsfeed, and further instill doubt and confusion.

Cash-intensive businesses are the target

Although it may appear that government agencies are all criminals care about, small and medium-sized businesses are just as lucrative as targets for serious and organized crime. In fact, the report lists business email compromise fraud as one of the most effective ways to extract data.

According to the EU-SOCTA, all business sectors are potentially at risk of being infiltrated or exploited by criminals. However, the 3 most affected sectors are construction and real estate, hospitality, and logistics.

In some cases, data holds more value than money. It’s treated as a commodity and is at the forefront of illicit trade. Its value is in its reusability. Possession of valuable information puts a massive target on the potential victims’ backs. If stolen, strategically important data can be sold for espionage, economic advantage, or used for coercion.

Large-scale data breaches often involve login credentials dating 5 years back or older. This puts breached organizations in a particularly vulnerable situation—they may not know that their data has been compromised until years later, when a folder containing terabytes of sensitive information suddenly appears on a dark web forum.

Europol emphasizes that protecting the victims is essential to successfully tackling serious and organized crime. One key way to achieve this is cutting off the funding source for serious and organized crime at its root. Although recovering assets can be complicated, shutting criminals out from accessing them in the first place has proven to be effective. Asset recovery has proven to deter cybercriminals from pursuing further operations, as they can’t reintegrate stolen assets into the mainstream economy.

How can you improve digital defenses against serious and organized crime?

The 3 core pillars of the new DNA of serious and organized crime are:

• Destabilization of society through illicit proceeds and the use of proxies.

• Nurturing of crime in online spaces.

• Acceleration of crime thanks to AI and other emerging technologies.

The 2025 EU-SOCTA can paint a grim first impression of the current threat landscape. However, the situation is not hopeless. This research doesn’t just help Europol discover malicious agents faster and with more precision—it indicates the potential future trends, allowing businesses and individuals alike to prepare for evolving risks.

For businesses concerned about serious and organized crime, one of the best ways to stay protected is to conduct transparent operations in accordance with legal requirements and compliance policies, such as ISO-27001, NIST, or NIS2. Upon detecting suspicious activities that could be caused by serious and organized crime actors, companies should contact their legal authorities immediately.

Employee education also goes a long way. Ensure your organization is practicing proper digital hygiene and adhering to a strong and flexible password policy and secure credential usage and sharing norms. Keep your team aware of emerging threats, common scam tactics, and risks posed by AI-powered technologies.

Hybrid problems require hybrid solutions, and Nord Security offers you exactly that. Start proofing your business against complex cybercrimes with a custom-tailored cybersecurity bundle of NordPass, NordStellar, and NordLayer.

• NordPass is a password manager that helps organizations handle and share sensitive data without compromising its integrity.

• NordLayer is a network security, threat detection, and response platform that integrates seamlessly with any technology stack.

• NordStellar is a threat exposure management platform that monitors the dark web, helping organizations stay ahead of cyber threats.

If you had to put a price on your data—say, your ID number, or one of your social media passwords—what would you say it’s worth? Would it shock you to learn that, if it ever got leaked, it could be sold on the dark web for just a few bucks? Well, buckle up then… because it only gets worse.

It’s a black market, not an auction

We all think our data is super valuable—after all, it’s ours. Companies like Google and Facebook think so too, using it to personalize experiences, fine-tune algorithms, and make their ads more relevant. You’d probably assume that means your data is worth a lot of money, especially with everyone saying that “data is the new oil.” But the reality is that some of it might not hold much value to hackers on the dark web. How so?

The dark web is packed with tons of data being traded all the time. So if yours got leaked, it could just be another piece in the pile. That doesn’t mean it wouldn’t get picked up and used against you—it just means someone might not have to pay much for it. Harsh, we know, but true. With no rules or oversight in illegal markets, even the most sensitive info could sell for a shockingly low price.

What data is sold on the dark web?

The types of data you’ll find on dark web markets range from the obvious—like stolen passwords, business credentials, bank statements, credit card details, emails, bills, and ID cards—to the less expected, like user account activity, browsing history, utility bills, license plate numbers, and store receipts.

To put it differently, if there’s information about a person or a business that exists somewhere online, it can end up for sale on the dark web. It’s that simple.

The price tag on different types of stolen data

Cybercriminals price data depending on the type and what they can achieve with it. Therefore, in general, they place less value on passwords for personal social media accounts than on things like IDs or health insurance cards.

Not too long ago, experts at NordLocker analyzed a dark web marketplace to get an idea of the average prices for various stolen items. The table below shows their findings. Keep in mind, however, that there are at least 30 major dark web markets, and their listings are always being updated with new items and prices.

To give you a few more examples: according to Privacy Affairs’ Dark Web Price Index, credit card details with an account balance of up to $5,000 sell for around $110 on the dark web. Crypto accounts range from $20 to about $2,500, while stolen logins to platforms like Spotify, HBO, Hulu, and Airbnb can go for as little as $1 to as much as $300.

Of course, most of this is personal data, but business and enterprise data is also being sold on the dark web. We’re talking digital items like API keys, RDP passwords, cloud infrastructure logins, and other things that could give hackers access to a company’s IT systems and sensitive information. And the prices? They can range from $500 to over $100,000, depending on the size of the targeted company and the potential impact.

Fact: cheap data can actually be worth more

What’s important to know—and also terrifying—is that the same piece of data can be worth much more than what it initially sells for on the dark web.

As explained by Daniel Kelley—a former black-hat hacker turned cybersecurity educator—in a recent AMA on Reddit, personal passwords for consumer accounts like Netflix usually go for just $5 to $25. However, if someone is reusing their Netflix credentials for something more valuable, like a work account or business platform, suddenly that $5–$25 password could be worth hundreds of thousands of dollars.

The point is, data that goes for next to nothing on the dark web can end up being a goldmine for cybercriminals. If those stolen credentials work across multiple business accounts or systems, it could cost attackers just a few dollars to cause millions in damage to targeted organizations.

How does your data end up on the dark web?

Cybercriminals have a few go-to methods for getting their hands on personal or company data and selling it on the dark web. One of the most common is using malware—like Trojans, spyware, keyloggers, and stealers—which are specifically designed to steal passwords, credit card details, crypto wallet keys, and other sensitive data.

Malware threats usually spread through phishing emails with malicious links or attachments, fake websites, or even disguised as software updates. Once installed, they can scan the system, sift through files and browsers, record keystrokes, take screenshots—and do it all quietly, without the user ever realizing it’s happening.

Another way data—especially business data—gets compromised is when databases or code repositories are left exposed online. Misconfigured cloud storage or weak access controls can leave the door wide open for attackers to swoop in and take whatever they find. Once they’ve obtained the data, the next step is to upload it to the dark web, put a price on it, and wait for the buyers.

What can you do to prevent data exposure?

While everything we’ve covered so far may be overwhelming and spine-chilling, rest assured that you are not without options. There are several habits you can quickly adopt to protect your data from being exposed and sold on the dark web. Here are a few important steps to consider:

Don’t interact with suspicious emails and websites

We’ve all come across fake websites and scam emails at some point—it’s how we respond to them that matters. If something looks fishy, off, or just doesn’t feel right, don’t engage. Don’t click on any links, don’t enter your info, don’t log in with your Google or Facebook account. Just steer clear and avoid any interaction.

Avoid oversharing information online

Putting a spin on a popular saying: “What happens online, stays online.” This means that if you share something in the digital world, it’s highly likely that a trace of it will always remain. So, be mindful of what you share online. You never know how much information attackers might use to try to trick you with their advanced social engineering techniques.

Enable multi-factor authentication (MFA)

Relying on just a password to protect your accounts isn’t enough these days, especially if your passwords aren’t exactly strong. That’s where multi-factor authentication steps in. It adds an extra layer of security by requiring additional proof of identity (like a code sent to your phone) to confirm that it’s really you trying to log in. This means that even if someone gets hold of your password, it’s much harder for them to actually break in and steal your data.

Set up data breach alerts

One of the most important steps in solving a problem is knowing it exists in the first place. If your data has been compromised, the sooner you find out, the better your chances of minimizing the damage. For example, if you learn that your login credentials have been posted on the dark web, you can try to change your passwords before anyone has a chance to use them. Or, if something like your scanned ID card shows up, you can alert the authorities and start the process of getting it replaced. That’s why it’s smart to use the dark web and data breach monitoring tools, like NordPass’ Data Breach Scanner. They automatically scan the web for any signs that your data has been compromised and alert you right away if they detect anything suspicious.

Use a password manager

You really can’t afford to rely on old, weak, or reused passwords to protect your online accounts. What you need is a robust password manager like NordPass to keep things safe. It lets you create strong passwords for all your accounts and store them—along with your passkeys, credit card info, and other sensitive data—in a secure, encrypted vault. Plus, with handy features like autofill and Secure Sharing, you’ll be less likely to accidentally type your credentials into a fake website or send them through unprotected channels. If you want to protect access to your accounts, this is the way to go.

And how can businesses protect themselves?

For businesses, especially enterprises, defending against cyberattacks and preventing data from leaking into the dark web is no small task. But there are a few steps every organization can take to help avoid exposing sensitive company information. Those are:

Educate your employees

Human error is still a major cause of data breaches. So, investing in security training for your team is essential. It helps your employees realize how one small mistake can put the whole company at risk, and shows them how to use defense tools and follow processes so they can work efficiently and make smart cybersecurity choices.

Establish strong access controls

To protect your company from leaks, you need to know what information is shared, who it’s shared with, and why. You also need strict access rules based on the zero-trust principle—no one gets easy access, and everyone has to be authorized to get in. You can use tools like NordPass to keep track of how access is granted, managed, and shared across your teams—and revoke it if things start to go too far. This will help you limit and effectively secure access points to your company’s data.

Always keep your data in a truly safe place

Just like today’s data privacy laws, like HIPAA and GDPR, require your company to handle and store customer data securely, your internal security policies should do the same for all company data. That means making sure your company’s digital resources are stored in a secure environment where only authorized people can access them.

This can be achieved through encrypted cloud servers, a segmented network with monitored access points, and tight control over who can access sensitive information. Not only does this keep your data protected—it also shows clients and partners that they can trust you to keep their data safe and sound.

Bottom line

Some stolen digital goods are available for purchase on the dark web at shockingly low prices, like $5–$25 for a stolen online account password. Depending on the potential impact, prices can increase, especially for items that could give attackers access to a company’s IT infrastructure and databases.

Still, the cost of stolen data on the dark web is minimal compared to the illegal profits attackers can make and the financial damage they can cause to individuals and organizations. That’s why, whether you’re a regular Internet user or a large-scale company, you need to invest in strong cybersecurity tools and be vigilant about your online activities to minimize your digital footprint and prevent data leaks.