Sensitive Data Categories Most Commonly Leaked on Dark Web

Introduction

In April 2024, a single post on a successor forum to BreachForums offered access to a corporate database containing over 22 million unique email addresses, full names, and hashed passwords. The asking price was $4,500 in Monero. What made this dump particularly damaging was not the volume, but the sensitivity: alongside the credential data, the archive contained employee passport scans and internal Slack message exports. This is not an isolated incident. Across ransomware leak sites like LockBit's portal, ALPHV/BlackCat's data leak site, and Telegram channels dedicated to data trading, the categories of data exposed by organizations continue to proliferate. Understanding the sensitive data categories most commonly leaked on dark web is the first step in building an effective data leak detection program. This article is written for CISOs, SOC analysts, and data governance leads who need to know exactly what types of data appear in dark web leaks, where they surface, and how to monitor for them systematically.

We will break down the specific data categories—from PII and PHI to source code and configuration secrets—that threat actors target and trade. We will map each category to the dark web infrastructure where it appears, the tactics used to exfiltrate it, and how an advanced data leak detection platform can identify exposure before it leads to regulatory fines or reputational collapse.

PII: The Dark Web’s Most Liquid Asset

Personally Identifiable Information (PII) remains the most traded category of leaked data across dark web marketplaces and forums. The IBM Cost of a Data Breach Report 2024 pegs the average per-record cost of a PII breach at $165. When a database containing hundreds of thousands of records appears on a leak site, the financial and compliance implications for the originating organization are immediate.

What Specific PII Data Points Are Most Commonly Leaked?

The most exposed PII categories are full names, email addresses, phone numbers, physical addresses, dates of birth, and national identification numbers (such as Social Security Numbers in the US or Aadhaar numbers in India). A single dump from a compromised e-commerce platform can contain all of these fields for millions of customers.

• Email addresses and plaintext passwords: These are the most commonly leaked PII combination. They appear in credential stuffing lists compiled from stealer malware logs sold on Russian Market or the XSS.is forum.
• Government-issued ID numbers: SSNs, passport numbers, and driver’s license numbers appear in dumps from financial services and government contractors. These fetch a premium because they enable identity theft and synthetic identity fraud.
• Financial account details: Bank account numbers, routing numbers, and credit card data with CVV2 codes are sold in structured formats on carding shops and private Telegram channels. Ransomware groups like Cl0p frequently include financial documents in their leak-site postings.

According to the Identity Theft Resource Center (ITRC) 2024 Annual Data Breach Report, 43% of all confirmed data exposure events involved the compromise of Social Security Numbers or other national identifiers, making this sub-category the highest-risk data class for US-based organizations.

PHI: Healthcare Data’s Double Extortion Risk

Protected Health Information (PHI) is a high-value, high-consequence category of leaked data. Under HIPAA, a single PHI exposure event of 500 or more records triggers mandatory notification to the HHS and media outlets. Ransomware groups have targeted healthcare organizations with increasing precision, knowing that the operational disruption to patient care creates pressure to pay, and that the data itself carries exfiltration leverage.

Which PHI Fields Appear Most Frequently on Ransomware Leak Sites?

The most common PHI elements leaked include medical record numbers, diagnosis codes (ICD-10), treatment histories, insurance policy IDs, and physician notes. Play Ransomware and BlackCat/ALPHV have both posted sample archives from healthcare victims that include patient intake forms and lab results.

• Medical histories and diagnosis records: These are sensitive beyond HIPAA—they expose intimate health details that cannot be changed, unlike a password or credit card number. Their exposure creates ongoing blackmail risk for individuals.
• Health insurance subscriber data: Insurance IDs combined with SSNs are a goldmine for medical identity theft, where fraudsters use stolen PHI to obtain treatment, surgery, or prescription drugs under another person’s coverage.
• Clinical trial participant data: Leaked clinical trial data from pharmaceutical companies has been posted on forums like Exploit.in. This data includes patient consent forms, adverse event reports, and unblinded trial results, carrying both regulatory and competitive implications.

Healthcare organizations must prioritize PII and PHI data leak detection as a core compliance capability, not merely a security precaution.

Source Code and Intellectual Property: The RDP of the Dark Web

Source code leaks have become one of the most strategically damaging categories of data exposure. Threat actors exfiltrate proprietary source code during ransomware incidents and post it on leak sites to maximize pressure on victims. In 2023 and 2024 alone, leaks from major technology firms, game studios, and SaaS providers appeared on ransomware portals and code-sharing platforms misconfigured to be publicly accessible.

What Types of Source Code Are Leaked and Where Do They Appear?

The most common source code leaks include web application code, mobile app codebases, API endpoints, proprietary algorithms, and internal tooling. These frequently surface on ransomware leak sites as part of a double extortion tactic, but also appear on paste sites like Pastebin and on Telegram channels dedicated to data dumping.

• Web application and API source code: This is the most frequently leaked category because it is the most accessible during a network intrusion. Attackers target internal repositories like GitLab and Bitbucket instances, exfiltrating entire repositories. MITRE ATT&CK technique T1213 (Data from Information Repositories) describes this exact tactic.
• Proprietary algorithms and trade secrets: In sectors like autonomous vehicles, financial trading, and semiconductor design, source code leaks represent an existential competitive risk. The accidental exposure of a proprietary AI model’s architecture on a public code repository has real market consequences.
• CI/CD pipeline configuration and deployment scripts: These are particularly dangerous because they often contain hardcoded secrets, API keys, and cloud service credentials. Their exposure on a leak site effectively hands attackers the keys to the production environment.

Mandiant’s M-Trends 2024 report found that intellectual property theft represented 27% of all data exfiltration motives attributed to state-sponsored threat actors, with source code and engineering data being the primary targets in 61% of those cases.

Credentials, API Keys, and Configuration Secrets

Credential leaks occupy a unique position on the dark web because they are both a commodity and a tool. Stolen credentials—whether from infostealer malware, credential stuffing attacks, or corporate database dumps—are traded on forums, Telegram channels, and automated shopfronts. API keys and cloud service secrets, when leaked, often go undetected by traditional DLP systems.

What Makes Credential Leaks So Persistent and Difficult to Detect?

Credential leaks are persistent because credentials are static assets that remain valid until explicitly rotated. A single credential compromise can remain exploitable for months. The dark web infrastructure for trading them is vast and automated, with channels on Telegram offering real-time feeds of newly stolen credentials.

• Stealer malware logs: These are collected by malware families like RedLine, Vidar, Raccoon Stealer, and LummaC2. The logs contain browser-saved passwords, session cookies, cryptocurrency wallet keys, and auto-fill profiles. They are sold in bulk on Russian Market and traded in private Telegram groups.
• Corporate VPN and RDP credentials: These appear on ransomware access broker forums like RAMP and XSS.is. Threat actors specifically seek out domain admin credentials and VPN logins because they enable lateral movement and data exfiltration. MITRE ATT&CK technique T1078 (Valid Accounts) covers this initial access vector.
• Cloud API keys and service account tokens: Leaked AWS secret keys, Azure service principal secrets, and Google Cloud service account keys are frequently found in publicly exposed configuration files on GitHub and in misconfigured cloud storage buckets. Tools like TruffleHog detect these, but detection is often only after the exposure has already been indexed by search engines.
• Database connection strings and environment variables: These are commonly embedded in .env files, Docker Compose configurations, and application properties files. When these files are posted in a database dump or on a paste site, they grant direct access to backend databases and message queues.

The relationship between credential leaks and ransomware is well established: in over 70% of ransomware incidents involving data exfiltration, the initial access vector was a compromised credential.

Cloud Storage and Backup File Exposures

Misconfigured cloud storage infrastructure is one of the most common mechanisms of accidental data leaks. When an S3 bucket, Azure Blob container, or Google Cloud Storage bucket is set to public read access, the contents become discoverable by automated scanners and search engines. These exposures are not the result of an attacker breaking in—they are the result of a configuration error that makes data publicly accessible.

What Types of Data End Up in Misconfigured Cloud Storage?

The data found in leaked cloud storage buckets spans every category on this list. Backups are particularly dangerous because they are complete, unredacted copies of production data including database dumps, file shares, and application logs.

• Full database backups: These contain every table, including user profiles, transactions, and internal notes. A single misconfigured backup bucket containing a MySQL dump from a healthcare application can expose millions of PHI records.
• Log files and debugging artifacts: Application debug logs often contain full SQL queries, user session tokens, and API payloads. These are rich sources of sensitive data that security teams rarely consider as an exposure vector.
• Configuration and infrastructure files: Terraform state files, CloudFormation templates, and Kubernetes manifest files contain the entire blueprint of an organization's cloud infrastructure, including VPC IDs, subnet CIDRs, and security group rules. Their exposure facilitates targeted attacks.

The 2024 Verizon Data Breach Investigations Report (DBIR) noted that cloud asset misconfigurations were the root cause in 22% of all data exposure events involving cloud-based storage, making it the single most common misconfiguration-driven exposure path.

Organizations should extend their data leak detection beyond OSINT techniques to include continuous scanning of cloud storage permutations and public code repositories for their organization's data patterns.

Financial and Payment Card Data

Financial data—including credit card numbers, bank account details, transaction records, and payment processor credentials—commands a premium on the dark web because it can be immediately monetized. Ransomware groups like Cl0p and Royal frequently target financial services firms and payment processors specifically for this data category.

Where Does Financial Data Surface After a Breach?

Financial data follows a distinct lifecycle after exfiltration. It first appears as a full dump on a ransomware leak site as proof of exfiltration. Within 48 to 72 hours, the structured payment data is extracted and sold on carding platforms and Telegram channels.

• Full card-not-present (CNP) data: This includes the primary account number (PAN), expiration date, CVV2 code, and sometimes the cardholder’s billing address and IP address. This data is sold for between $5 and $30 per record depending on card type, issuing bank, and verification level.
• Bank account and routing numbers: These appear in business email compromise (BEC) exfiltration events and in dumps from payroll processors. They are used for ACH fraud and wire transfer diversion.
• Cryptocurrency exchange account data: Leaked Know Your Customer (KYC) documentation from cryptocurrency exchanges—including passport photos, proof of address, and selfie verifications—is traded on forums and used for account takeover and exchange withdrawal fraud.

Monitoring for this data category requires specialized real-time dark web monitoring that tracks carding shops, Telegram channels, and ransomware leak sites concurrently.

Internal Communications and Legal Documents

Internal communications—including email threads, Slack messages, Microsoft Teams transcripts, and legal correspondence—are a frequently overlooked but highly damaging category of leaked data. Ransomware groups know that exposing internal communications can cause disproportionate reputational harm, regulatory scrutiny, and litigation risk.

Why Do Internal Communications Appear on Leak Sites?

Ransomware groups deliberately exfiltrate email archives and collaboration tool databases because they contain the most candid and strategically valuable information: negotiations, strategic plans, partnership discussions, and employee disciplinary matters.

• Executive email archives: These contain confidential board communications, merger and acquisition discussions, and financial forecasts. Their publication can impact stock price and business relationships.
• Legal correspondence and settlement agreements: Leaked attorney-client privileged documents or pending settlement terms create immediate legal jeopardy and privilege waiver concerns.
• HR and employee relations data: Salary data, performance reviews, internal investigations, and termination letters are commonly found in ransomware leak-site archives. Their exposure damages employee trust and can trigger class-action litigation.

Data leak detection must cover the unstructured data within email and collaboration platforms, not just structured database fields. DarkThreat.AI's platform monitors for patterns indicative of internal communication archives across ransomware leak sites and paste sites.

How DarkThreat.AI Approaches Sensitive Data Leak Detection

DarkThreat.AI continuously indexes and classifies data across the full spectrum of dark web infrastructure: ransomware .onion leak sites (LockBit, ALPHV, BlackBasta, Akira, Hunters International), paste sites (Pastebin, Ghostbin, Rentry), Telegram channels used for data trading, deep web forums (BreachForums successors, XSS.is, Exploit.in, RAMP), and public code repositories. The platform uses content fingerprinting against organization-specific data patterns—not just keywords—to detect leaked PII, PHI, source code, credentials, and financial data. When a match is identified, DarkThreat.AI enriches the alert with severity scoring, data category classification, and context on the posting source, enabling SOC teams and legal/compliance leads to prioritize remediation based on the specific sensitive data categories most commonly leaked on dark web that are relevant to their risk profile.

Related Resources

• What Is Data Leak Detection? — Foundational overview of how data leak detection works across dark web, paste sites, and leak portals, including the data categories covered.
• Ransomware Groups and Their Leak Sites: The Double Extortion Playbook — Analysis of named ransomware groups and their specific leak-site infrastructure, with case studies of data category exposure during extortion campaigns.
• PII Data Leak Detection and GDPR Requirements — Mapping specific PII data categories to GDPR Article 4(1) definitions and breach notification timelines under Article 33.
• Data Leak Detection vs DLP: What is the Difference? — Comparison of the coverage limitations of traditional DLP for data already outside the perimeter versus dark web detection techniques.

Conclusion

The sensitive data categories most commonly leaked on dark web span far beyond the PII that dominates breach notification headlines. Source code, API secrets, PHI, cloud storage backups, internal communications, and financial data all appear regularly on ransomware leak sites, paste sites, and dark web marketplaces. Each category carries distinct regulatory, financial, and reputational consequences. The organizations that successfully mitigate these exposures are those that have moved beyond reactive breach notification to continuous, category-specific data leak detection across the full dark web attack surface.

As ransomware groups refine their exfiltration tactics and stealer malware logs become more granular, the diversity of data categories appearing on leak sites will only expand. The intelligence layer that separates a proactive security posture from a reactive one is the ability to detect exactly what data category has been exposed, where it is being traded, and how quickly it can be remediated. Tools like DarkThreat.AI provide this capability by combining broad coverage with granular classification, giving organizations the visibility they need to stay ahead of the leak cycle.