An Australian’s tax file number, date of birth and home address can all be purchased in a bundle on the dark web for just $280.
Cybersecurity companies NordVPN and NordStellar have trawled dark web marketplace listings to compare the cost of illegally buying someone’s personal details stolen from various countries.
Among some 75,000 listings were the card details of Australians being sold for $US10 ($A14), Netflix logins for $US5 or a bundle of tax file number, date of birth and address for $280.
Australian bank card details selling for a median price of $US10 is on par with the US, the researchers note, and among the cheapest. Stolen data is far less common in countries such as Japan and Singapore, so cards from those countries cost more on the dark web.
“For less than a weekly grocery shop, a criminal can buy enough personal information to file fraudulent tax returns or start building a fake identity in someone else’s name,” NordVPN chief technology officer Marijus Briedis said.
“Every online account you own has a price tag on the dark web – your streaming subscriptions, your email, your bank login, your social media profiles.
“Most people would be shocked at how little it costs a criminal to buy their entire digital identity.”
While US and Australian bank card details are among the cheapest to buy illegally, the full package of an Australian’s tax file number, address and date of birth goes for about six times the cost of an American’s. The researchers say this price difference suggests Australians’ details are harder to come by and more valuable to criminals.
A scan of an Australian passport sells for about $45 and a driver’s licence for about $54.
The researchers analysed the 75,000 marketplace listings from nine dark web marketplaces between January 2025 and February 2026.
The analysis shows criminals are far more interested in corporate email addresses than personal ones. While a bulk of personal addresses can sell for just $1, stolen Australian Microsoft Office 365 accounts sell for a median price of $US26.50 (about $A36.90).
The analysis found 227 Australian Office and GoDaddy mail addresses for sale.
“Initial access brokers, criminals who specialise in breaching company defences and selling that access to other hackers, overwhelmingly target North American and Western European corporate infrastructure,” the researchers say.
“But Australia, ranking ninth globally for corporate email listings, is firmly on their radar.”
Facebook accounts are the most common social media accounts for sale, accounting for 40 per cent of listings and selling for about $53. A stolen Facebook login can open the door to connected Instagram accounts, business pages and advertising tools.
Snapchat accounts sell for a few dollars less, while TikTok accounts are worth almost double.
Netflix accounts sell for about $6, and Spotify accounts typically go for $39.
Stolen Amazon accounts sell for about $70, allowing criminals to use gift cards and store credits to launder money or purchase easily resold items.
Crypto exchange accounts are among the most expensive for sale because a stolen credit card requires complicated money laundering, but a stolen crypto wallet can easily be turned into cash.
