Understanding the Dark Web: The Case of Internet Fraud (Part 2)
Through anonymity, the Dark Web functions as the Internet’s equivalent of an underworld. While anonymity has its advantages, online fraud and scams frequently abuse the ability to hide behind a screen. Just recently, in February 2025, the hacker team of the B1ack’s Stash marketplace leaked over one million stolen credit and debit cards into a Dark Web forum for free. These leaks containing card numbers, expiration dates, CVV, and cardholder information were out in the public domain and life threatening in nature, posing a high risk of identity theft as well as financial fraud. Unlike most transactions on the Dark Web where the information is stolen and sold, this information was freely available for cybercriminals to use to their advantage which increased the magnitude of destruction.
The stolen financial details were sourced from previous skimming breaches along with phishing attempts towards banks and online payment systems. Once exposed, the credit card details were rapidly put into circulation via underground hacking forums making it extremely difficult for the authorities to track down the information. Defrauded clients found themselves: facing unauthorized transactions, account take overs, and extreme financial hardship.
This case elucidates the position of the Dark Web as a central hub for illegal financial data where criminal entities adopt a multitude of methodologies to steal sensitive data and sell or leak it.Find the full story here (https://securityaffairs.com/174488/cyber-crime/b1acks-stash-released-1-million-credit-cards.html). This article explores some of the most notable cases in which the Dark Web not only exposed data but also created huge scams against public people and entire organizations.
Case Study 1: Duolingo Data Scraping Incident (2023)
During August 2023, a well-known language-learning platform, Duolingo, became the victim of a data scraping incident where the records of 2.6 million users was compromised via an unsecured application program interface (API). The scraped information, which contained email addresses, usernames, and other provided details, was later posted for sale for $1,500 in a Dark Web hacking forum. By having access to this data on Dark Web, users became vulnerable to phishing scams and other malicious actions that put into perspective the need to tightly secure APIs and other interfaces to prevent data breaches. Read the full story https://www.office1.com/blog/horror-stories-from-the-dark-web
Case Stud 2: The Silk Road Bitcoin Seizure
In November 2021, James Zhong was apprehended for illegally acquiring Bitcoin in 2012 from the Silk Road marketplace. Law enforcement recovered 50,676 Bitcoin, which was valued at $3.36 billion at the time. He was able to acquire so much Bitcoin because he took advantage of a flaw in the Silk Road’s payment system. This illustrates how Dark Web facilitates financial crimes of this scale: loopholes that allow individuals to steal great amounts without being noticed. On the other hand, the case details illustrates one of the consequences of engaging in malevolent behavior on the Dark Web – the criminals get “lost” for years, but ultimately they are outed, and most of the time, face legal action. More dangerously, the anonymity and decentralization of the transaction on the Dark Web allows the increase of fraud, money laundering, and organized cybercrime to take place creating danger for the people and the economy or country’s financial system. Read the full story https://www.justice.gov/usao-sdny/pr/us-attorney-announces-historic-336-billion-cryptocurrency-seizure-and-conviction
Case Study 3: Yahoo Data Breaches (2013-2014)
Between 2013 and 2014, Yahoo was the victim of two of the biggest breaches in history which compromised billions of users accounts with the potential of being defrauded or cyber attacked. Breach number one happened August in 2013 and compromised all 3 billion Yahoo accounts. It did not come to public attention until 2016 when Yahoo claimed a billion accounts were breached. An inquiry carried in 2017 found out that the breached accounts had all of a user’s details stored including but not limited to their username, emails, phone number, birth dates and even passwords. This array of information set off alarms for Cybercriminals because is was a jackpot for those searching for credentials in the Dark Web.
The second breach took place in late 2014 which added another 500 million stolen accounts. This hack was assigned to state support hackers affiliated with Russia’s intelligence. In contrast to the 2013 breach which merely targeted user information, the 2014 breach focused specifically on high net worth accounts like journalist, diplomats and government personnel. To execute these hacks, cybercriminals exploited and changed Yahoo’s web cookies, hence permitting them into accounts without any need for passwords. The stolen Yahoo accounts and information were later found on the darkweb as the case of cyberattacks, identity frauds and financial scams using this information are on the rise. These breaches made clear the already known dangerous reality of the darkweb while also exposing the risks that come with poor cyber security measures. Read the full story https://en.wikipedia.org/wiki/Yahoo_data_breaches
Case Study 4: Shanghai Police Database Leak (2022)
In July 2022, a hacker operating under the alias “ChinaDan” purportedly claimed to penetrate the Shanghai National Police Database and claimed to have access to over twenty-three terabytes of top-secret records about one billion residents of China. This leak is deemed as one of the largest cybercrimes on record and is still debated due to the nature of sensitive data that includes names, addresses, place of birth, national ID, registered phone numbers, and even portions of police reports such as the nature of crimes and case details associated with the individual.
These terabytes of databases were put up for auction on Dark Web forums with the hacker initially bidding it for ten bitcoin which was at the time valued at an upwards of $200,000. During that time, China was plagued with strict cybersecurity laws which made people raise eyebrows as it appeared as if the databases where being hosted on low grade cloud servers that were not properly secured. After this incident, many professionals began arguing that poor regulation of accessing these accounts paired with feeble encryption led to the breach. The leak provided ample information for criminals and fraudsters who aimed to impersonate or financially scam individuals which elevated the political scandal by forcing authorities to lessen the discussion around the leak. Read full story https://cyberscoop.com/shanghai-data-breach-1-billion-dark-web/
Conclusion
One of the riskiest and most hidden areas of the internet is the Dark Web. Cybercriminals use it as a marketplace to deal in fraudulent behavior, stolen data, and manipulating people and organizations. The real-life examples show how disastrous data breaches can be. Victims of breaches run the risk of money theft, identity fraud, and reputational damage, and government and corporate organizations must attempt to control the impact. My peer’s comment regarding this case highlights how anonymity makes it impossible to identify and attribute the offenders. As a result, cybercrime networks can continue to grow and flourish.
Cybersecurity must be a top priority for individuals and businesses when it comes to self-defense. Strong multi-factor authentication, unique and complicated passwords, and the most recent security software and systems are all necessary for various accounts. Since phishing emails and links are common means for thieves to obtain information, avoiding them is equally crucial. If and when sensitive data is saved, it must be encrypted in order to be exposed in the event of a breach. Using a VPN when using the internet also improves privacy. For a deeper understanding of cybersecurity best practices, you can read more at this resource.