Introduction
In April 2025, a threat actor using the handle "Selluminati" on a successor forum to BreachForums listed a 1.2-terabyte database dump for a major financial services firm, pricing it at $4,500 in Monero and offering a "verified sample" to serious buyers. The listing included the victim's industry, the database type (PostgreSQL), the estimated number of records (340 million), and the types of data fields compromised—a level of categorization that has turned criminal forums into purpose-built marketplaces for stolen data. Understanding how criminal forums categorize and sell leaked databases is no longer optional for security teams; it is the foundation of an effective data leak detection strategy. This article explains the specific taxonomy, pricing tiers, and trust mechanisms these forums use, and it maps these signals to the detection capabilities your team needs to monitor them effectively.
Written for CISOs, SOC analysts, and threat intelligence leads, this article answers the question: How do criminal forums structure their listings, and what does that mean for how we detect and respond to our organization's data appearing for sale?
How Forums Categorize Leaked Databases
Criminal forums did not arrive at their current sophisticated categorization system overnight. The evolution from chaotic, unstructured posts in 2018-era RaidForums to the organized marketplace architecture of BreachForums 2.0, Exploit.in, and XSS.is mirrors the professionalization of the data exfiltration economy. Today, a seller posting a leaked database must navigate a structured taxonomy that includes industry classification, data type tagging, geographic origin, and database technology.
What Is the Standard Industry Classification on Criminal Forums?
Forums typically organize listings by broad industry verticals: Financial Services, Healthcare, E-commerce, Government & Public Sector, Telecommunications, Technology & SaaS, and Education. Within each, sellers add sub-tags—"Banking" under Financial Services, "Insurance Broker" under Healthcare adjacent, "Gaming" under Technology. This mirrors the industry segmentation that data leak detection platforms must also adopt to route alerts to the correct incident response team. When a DarkThreat.AI analyst monitors a forum and sees a listing tagged "US Banking – 5M Records," the system can immediately correlate it against client organizations in that vertical.
How Do Sellers Classify Data Types and Sensitivity?
Listings are increasingly tagged with specific data field descriptors. A typical post might read: "Full Name, DOB, SSN, Email, Phone, Address, Account Number, Credit Card (truncated), Transaction History". Some advanced sellers now include a "sensitivity score" based on the presence of PII, PHI, or financial credentials. For instance, a database with plaintext passwords and SSNs commands a higher price tier than one containing only publicly available demographic data. This categorization directly informs detection priority: a listing that explicitly mentions SSNs, medical records, or API keys should trigger a higher-severity alert than one with only email addresses.
- PII fields: Full name, SSN, driver's license number, passport number, date of birth. These are the highest-value fields for identity fraud and command 3–5x the price of non-PII data.
- Financial credentials: Credit card numbers (including CVV2), bank account numbers, transaction histories, crypto wallet private keys. These are often sold separately from identity data due to shorter shelf life (card issuers detect and replace compromised cards within 7–14 days).
- Authentication data: Plaintext or hashed passwords, security question answers, API tokens, multi-factor authentication backup codes. Databases containing plaintext passwords trade at a premium because they require no cracking effort.
- Business intelligence: Internal emails, customer lists, vendor contracts, source code repositories, cloud configuration files. These are increasingly common as ransomware groups exfiltrate before encrypting and monetize the data on leak sites and forums simultaneously.
"The average listing price for a database containing SSNs on Exploit.in and BreachForums successors in Q4 2024 was $3,200, compared to $650 for databases with only email and password hashes." — Chainalysis 2025 Crypto Crime Report, Data Exfiltration Markets Chapter
Pricing Tiers, Volume Discounts, and the Economics of Leaked Data
The prices for leaked databases on criminal forums are not arbitrary; they follow a surprisingly consistent economic model that factors in data freshness, record volume, verification of authenticity, and buyer reputation. Understanding this pricing structure helps a security team assess whether a listing is credible and how urgently their organization should respond.
For example, a 2-million-record database containing SSNs and banking details less than two weeks old might list for $8,000–$12,000 on Exploit.in. The same database aged six months with only email addresses might fetch $400–$800. These economics explain why ransomware groups increasingly post data on leak sites and simultaneously list it for sale on forums—they maximize revenue through multiple distribution channels. Data leak detection platforms must monitor both channels because the timing of detection (before public release vs. during the sale window) changes the incident response playbook entirely.
What Is the Role of Escrow and Trust Mechanisms in These Sales?
Criminal forums have developed rudimentary but effective trust systems to facilitate high-value transactions between anonymous parties. Most forums use a built-in escrow service where the buyer pays the forum administrator, the forum holds the funds, the seller delivers the database, the buyer verifies it against the sample, and the forum releases payment after confirmation—minus a 5–10% commission. Forums also maintain public reputation scores for sellers based on completed transactions, user reports, and the accuracy of their data samples. A seller with a verified reputation score above 4.5 stars can command 20–30% higher prices because buyers trust they are not purchasing recycled data from previous breaches. This trust infrastructure turns the forum from a chaotic noticeboard into a functioning marketplace, and it creates a paper trail of sort—seller history, dispute threads, and escrow receipts—that threat intelligence teams can exploit for actor attribution.
Ransomware Leak Sites vs. Criminal Forums: Two Distributions for the Same Data
Modern double-extortion ransomware groups—LockBit, ALPHV/BlackCat, Cl0p, Akira, BlackBasta—operate their own leak sites (.onion addresses where they post stolen data when victims do not pay) and simultaneously list that same data for sale on criminal forums. This dual distribution strategy demands that a comprehensive data leak detection coverage map include both surface categories.
The key difference: ransomware leak sites announce the victim publicly as a pressure tactic, while forum listings may anonymize the victim until a buyer purchases the data. A security team monitoring only leak sites might detect a breach only after the ransomware group names and shames them publicly. A team that also monitors forum listings can potentially discover the data for sale before the public leak, enabling them to preemptively notify affected customers, engage incident response, and potentially negotiate with the threat actor without the added reputational damage of a public leak.
- Ransomware leak sites (T1651 – Data Exfiltration for Extortion): Posting is immediate upon missed deadline; victim organization is named; data is often provided in full or partially as a "proof pack." Detection focus: rapid identification of your organization's name and domain on known leak-site infrastructure.
- Forum marketplace listings (T1567 – Exfiltration Over Web Service): Listing may be anonymized; only a sample is provided; sale may precede public leak by days or weeks. Detection focus: identifying data samples that match your organization's data format, employee records, or internal naming conventions.
In 2024, the Mandiant M-Trends report documented a case where a healthcare organization discovered its data for sale on BreachForums 11 days before the ransomware group posted it on their leak site. The organization used that window to engage incident response, confirm the exfiltration scope (340,000 PHI records), and begin HIPAA breach notification preparation before the public disclosure. That 11-day head start is the exact operational advantage a dedicated data leak detection platform like DarkThreat.AI delivers.
"Organizations that discovered leaked data on forums or marketplaces before it appeared on ransomware leak sites reduced their average breach lifecycle by 34 days compared to those who learned of the breach through public disclosure." — IBM Cost of a Data Breach Report 2024, Detection and Escalation Analysis
How Sellers Package and Verify Database Dumps
The technical sophistication of how sellers package and verify database dumps has evolved significantly. Early BreachForums posts often contained simple CSV files or raw SQL dumps with no guarantee of authenticity. Today's sellers provide multi-factor verification: they offer a small sample (usually 100–500 records from random positions in the database), a checksum (SHA-256 or MD5) for the full archive to prove it is not a repackaged dump from another breach, and in some cases, a live query endpoint accessible over Tor that buyers can use to verify a specific email or username is present.
How Do Detection Platforms Verify That a Sample Is Relevant?
When a DarkThreat.AI monitoring sensor identifies a forum post claiming a database dump from "Company X," the platform's verification workflow begins. The sample file—if publicly accessible or obtained through controlled means—is ingested into a sandboxed analysis environment. The data leak detection engine parses the structure: field names, data formats, email domain patterns, internal ID numbering schemes. If 5–10 random records match known employee email addresses from the client organization (derived from a combination of corporate directory data and open-source intelligence), the match confidence score rises above the 95% threshold needed to trigger an alert. The platform also cross-references the claimed database size and record count against the client's actual database inventory—matching an e-commerce platform's customer table against a listing claiming 1 million customer records, for instance.
This verification process is critical because threat actors frequently repackage old data dumps from previous breaches and claim they are new exfiltrations. A well-known tactic on XSS.is involves taking a 2019 breach dump, filtering it for recent email addresses (those still actively sending mail), and relisting it as a "2024 breach" from the original victim. Verification against the actual breach timeline, data structure, and known field composition defeats this fraud and prevents your security team from chasing ghosts.
How DarkThreat.AI Monitors Criminal Forum Sales of Leaked Databases
DarkThreat.AI approaches criminal forum monitoring as a structured intelligence collection and verification problem, not a general web scraping exercise. The platform maintains persistent access to the major forums where leaked databases are sold—BreachForums successors, Exploit.in, XSS.is, RAMP, and several Telegram-marketplace hybrid channels—and uses a combination of automated crawling, human-confirmed account persistence, and known-actor monitoring to capture listings in near real-time.
Each listing is ingested into the data leak detection pipeline: the platform extracts the forum categorization tags (industry, data type, geographic region), the seller reputation score, the pricing and escrow details, and any publicly available sample files. The analysis engine matches these fields against each client's data perimeter—their known email domains, internal IP ranges, customer data structures, and partner ecosystem identifiers. When a match triggers, the alert includes the forum URL, the seller's username, the price, the record count, and a confidence score based on sample verification. This enables SOC analysts to immediately assess whether the listing warrants further investigation and whether breach notification timelines have been triggered.
The platform also tracks seller reputation over time. If a seller with a 4.8-star rating and 15 completed transactions lists data from your organization, the threat intelligence value is higher than a first-time seller with zero history. DarkThreat.AI's severity scoring incorporates seller credibility as a factor, ensuring that high-reputation actors selling your data generate the highest-priority alerts.
Related Resources
- What Is Data Leak Detection? Definition, Mechanisms, and Operational Value — Foundational reading on how data leak detection platforms monitor criminal forums, paste sites, and ransomware leak sites to identify exposed organizational data.
- Ransomware Leak Site Monitoring: A Practical Guide for Security Teams — Expands on the relationship between forum listings and ransomware leak sites, with specific monitoring workflows and alert triage criteria.
- Data Leak Detection vs OSINT: Why Purpose-Built Monitoring Beats Manual Collection — Explains the limitations of manual OSINT collection for forum monitoring and how automated verification addresses the scale problem.
- Data Leak Detection Coverage Map 2025: Forums, Leak Sites, Marketplaces, and Telegram — A comprehensive map of the dark web and criminal infrastructure your detection program must cover, including all major forum marketplaces.
Conclusion
Criminal forums have evolved into structured, trust-enabled marketplaces where leaked databases are categorized by industry, data type, freshness, and sensitivity. The economics of these sales—pricing tiers based on PII presence, exclusivity, and seller reputation—directly inform the urgency and severity of detection alerts. Security teams that understand this taxonomy can calibrate their incident response playbooks against the specific signals forum listings emit: industry tags, data field descriptions, sample verification requirements, and escrow transaction patterns.
As threat actors increasingly use dual distribution—listing data on forums while posting it on ransomware leak sites—the detection window between sale and public disclosure becomes the most valuable operational advantage an organization can have. Data leak detection platforms that combine persistent forum access, automated sample verification, and reputation-based scoring close that window. DarkThreat.AI's intelligence layer turns the messy, noisy marketplace of criminal forums into a structured early-warning system for data exfiltration—before the data is used for fraud, before the ransomware group names your organization publicly, and before the breach notification clock starts ticking.
