In This Article
Key Takeaways
- The PRC regards data as the fourth factor of production, along with labor, capital, and land.
- The country is developing a centralized market for the collection and trade of personal information.
- The darknet offers a wide range of personal data valued from a few dollars to thousands of dollars or more.
- China’s actions in the context of data centralization are a challenge for democracies.
China has become the world leader in data creation—thanks to its 1.1 billion Internet users and government initiatives in digital control. According to The Economist, authorities are turning information into a key resource alongside labor, capital, and land.
Facial recognition infrastructure and a centralized market for personal information are embedded not only in the economy but also in national security. This approach is becoming both a challenge and a lesson for democracies.
Chinese President Xi Jinping called data a key resource that can radically affect global competition. According to him, this vision covers a wide range of areas, from civil rights to the revenues of IT companies and China’s ambitions in the field of artificial intelligence.
The position of the head of state is being put into practice. In 2021, China issued rules modeled after Europe’s General Data Protection Regulation (GDPR). It is now moving away from Western norms.
There is a large-scale project underway to analyze big data sets in state-owned companies. The idea is to value them as assets, include them in balance sheets, or trade them on national exchanges. On June 3, the State Council promulgated new rules requiring all levels of government to share information.
Another element of the overall “mosaic” is the digital identifier, which will be launched on July 15. With it, the central government will be able to control the registry of websites and applications of each person.
It will become harder for the big tech companies that previously ran the system to link identity to online activity. They will only see an anonymized stream of numbers and letters.
China’s ultimate goal seems to be to create a “national ocean of data” spanning consumers, industry, and government activities, the publication noted.
Among the advantages of such an approach are savings on training AI models and lower barriers to entry for small new firms. Disadvantages include inefficient centralized information management.
Earlier, Shanghai police lost 1 billion records to hackers: names, addresses, birthplaces, national IDs, phone numbers, criminal records, etc. The database was put up for sale for 10 BTC. In per-person terms, this is a small value—a few cents for a complete dossier.
The new system may replace the current online monitoring, where lower-level law enforcement officials often exceed their authority.
How much is data worth?
Personal data is a huge market covering different areas:
Passport and identity data
Telephone numbers and contact information
Email accounts and passwords
Bank accounts
Medical information
Biometric data
Addresses, tax, and insurance numbers
Due to ineffective security measures of private companies and government agencies, information about tens or even hundreds of millions of people is online.
Chinese money-making scheme
The black market has a stable pricing system for different categories of personal data. The cost can vary dramatically—from a few dollars for social network accounts to thousands for access to bank accounts or closed databases. Leaks and insider trading have made information about Chinese citizens accessible and inexpensive, especially when seeking information for domestic purposes.
In many cases, sellers obtain sensitive data by hiring insiders from Chinese surveillance agencies and government contractors, and then resell their access without question to online shoppers. The result is an ecosystem where, for a small fee, anyone can request phone numbers, bank details, hotel reservations, flights, or even the location of the right person. Settlements are made in cryptocurrencies.
Attackers often sell not just one file, but a full set of personal data. It can include full name, date of birth, address, document numbers (passport, driver’s license), tax and social identifiers, bank details, and other information. Such dossiers are particularly valuable because they allow immediate use for identity theft, loan processing, and other schemes. In 2024, the cost of one set on the black market ranged from $20 to $100 or more.
The Chinese underground operates services that provide access to official data. By recruiting insiders in government agencies, intermediaries sell access to registries—for a few dollars, for example, a history of registered addresses or marriage data is provided. For a larger sum, scans of documents such as a passport or driver’s license can be purchased.
Such “online penetration” actually monetizes the state surveillance system. Researchers note that Chinese channels openly post advertisements for cooperation with employees of the Interior Ministry, civil administration, banks, and other institutions. They are promised rewards of up to 70,000 yuan per day (about $10,000) for access to data. This demonstrates the high shadow demand for personal information even within the country.
Contact information (cell phone numbers, email, mailing addresses) is often leaked en masse and sold in bulk. Since such information is of little value individually, the cost for a large list is low. For example, a leaked database of hundreds of thousands of email addresses can sell for as little as $10. In 2018, 200 million records with personal information of Chinese citizens (including about 130 million customers of the Huazhu hotel chain) were offered on darknet marketplaces at once.
Due to an overabundance of contact data, their value has declined in recent years. In 2014, a basic set of information about a person was valued at an average of $4, and in 2025 it will be just $1.
What is much more valuable is not the phone number itself, but the ability to quickly obtain information on it—for example, to learn the name of the owner, current or past locations, and call details. There are Telegram bots and private “suppliers” in Runet, where a request to “punch in” a phone number costs from 2,000 rubles for a single search. In China, underground services offer similar data for just a few dollars.
One study found that in a Chinese Telegram feed, you can pay the equivalent of $50–100 and find out all bank accounts registered to a particular phone number, associated services like WeChat and Alipay, and the subscriber’s recent geolocation data.
Logins and passwords
Compromised accounts of popular services are widely available on the black market. The price depends on the importance of the account (number of subscribers, linked payments, etc.).
According to the Privacy Affairs report, a hacked Gmail account sells for about $60 on average, while Facebook or Instagram accounts sell for $25. The low cost is explained by the scale of the leaks—millions of stolen logins and passwords are in circulation.
Less common or more privileged accounts are more expensive. For example, a hacked Uber driver account is valued at about $30, while an “upgraded” Airbnb account costs about $300.
Financial data
Even basic information like card number, CVV, expiration date, and owner’s name can be for sale, albeit at a low price when it comes to old leaks. On shady forums, a stolen credit card number can go for around $3. A full set of card data with a balance up to $5,000 is valued at about $110 to $120.
Accessing online banking directly is even more expensive. Accounts with small balances (up to about $1,000) can sell for $200–500, while accounts with large balances can sell for $1,000 or more. Fully verified accounts of payment systems and crypto exchanges cost hundreds of dollars: a hacked Revolut account—about $1,600, Kraken—about $1,170, Coinbase—$250.
Health
Medical data is considered to be one of the most sensitive types of data, and its value remains high on the black market. Electronic medical records contain not only personal information, but also medical history, test results, and insurance data. This information can be used for fraud or blackmail. According to estimates, the cost of a single medical record on the darknet averages about $250, and in some cases reaches $500 to $1,000.
The average “market” price of a medical record, as of 2024, is about $60. A Social Security number in the U.S. sold for $15 and credit card data for $3.
This shows that health information is valued several times more than “regular” information. The head of Qualys emphasized that leaked medical information is “far worse than most other information,” and cybercriminals understand that.
Biometrics
In 2025, there is a growing demand for biometric identifiers. If earlier passwords and documents were mainly in circulation, now criminals are hunting for what a person cannot change—fingerprints, facial templates, voice samples, iris scans.
Profile forums are already selling sets of stolen biometric data. For example, a full set of a person’s fingerprints sells for as little as $3–5, and a digitized facial image (for recognition systems) for $5–10 per record.
Biometric data tied to a financial account—fingerprints, facial photo, and voice—can cost from $25 to $100.
Addresses
Other personal data on the black market include such information as home addresses, date of birth, tax identifiers, insurance policy numbers, employment, education, and so on. More often than not, these data are not sold individually, but as part of the categories already discussed—leaked bases, complete dossiers, or document packages.
Basic personal data without financial information—for example, lists of clients with names, addresses, emails, and phone numbers—are priced inexpensively: about $5–15 per person.
Databases from the authorities (e.g., lists of registered voters, car owners, taxpayers) also regularly pop up on shadow resources. Prices vary depending on relevance and volume. For example, the voter database of one U.S. state was offered for about $100; similar lists could be posted for free.
Chinese dystopia
Many countries are looking to solve the problem of data management and control. According to The Economist, the Trump administration may consider hiring private tech company Palantir to consolidate government information. The EU may have to update GDPR rules. India’s Aadhaar identity system emphasizes privacy at the expense of potential economic growth.
In democracies, creating a large-scale and effective data management system is more difficult. It must take into account a balance of checks and balances, as well as protect property rights, privacy, and civil liberties.
China can pay less attention to such things and build an effective dystopian surveillance system. It has been a “fast follower” of Western innovation for decades. If the PRC now begins to demonstrate the financial value of its “national ocean of data,” its centralization method will pose not only an economic but also a political challenge.
