The Price of a Life Online: Valuing Personally Identifiable Information on the Dark Web

Prof. Andréanne Bergeron’s work on personally identifiable information, or PII, examines how different kinds of personal data are valued and used in cybercrime. The project was designed to answer a practical question: when someone’s data is leaked, how serious is the exposure? Rather than treating all personal information as equally risky, her research built a framework to assign severity scores to different types of PII using both dark web market prices and criminal sentencing data.

The study drew on two original datasets. The first included 348 price observations from academic papers, blog posts, and underground forum data, converted to 2026 USD for comparability. The second included 209 criminal cases from U.S. Attorney records and media reports, covering 43 laws and sentences ranging from 0 to 40 years. By combining these sources through a confidence-weighted fusion model, the project produced a more nuanced picture of PII severity than market prices alone could provide.

The findings show that personal health data is by far the most economically valuable type of personal information on the dark web, at about $300 per person, followed by PINs at around $196. By contrast, email addresses are worth less than a dollar on their own. However, when legal severity is considered, credit cards and social media profiles rank much higher. Dr. Bergeron’s work suggests that organizations, policymakers, and individuals should take a more risk-weighted approach to data protection, breach response, and privacy investments, focusing not only on what type of data was exposed, but also on what that data could enable.