Across Yorkshire, the personal data of 942,609 people is listed for sale on an underground marketplace, with the highest number being in Sheffield, Barnsley and Rotherham.
The illicitly obtained data – from email addresses and pictures, passport numbers and credit card details – is listed for sale on the “dark web”, encrypted areas of the internet hidden from ordinary search engines.
Detective Chief Inspector Vanessa Smith, who leads the Yorkshire and Humber Regional Cyber Crime Unit, said that criminals typically target “the low-hanging fruit” – people who have low levels of cyber security.
She said people can be too relaxed about their personal details online, leaving them open to identity theft by doing things like using public wifi when accessing their bank account details.
“On the dark web, there is information for sale all the time to the cyber criminal. They can sell that and use your data in a multitude of ways. They would rather steal your data than £5,000 in cash because it is worth more.”
Personal data has become one of the fastest-growing tradeable commodities online, with the figures nationwide leaping from one million to three million in the past four years.
If criminals eventually gather enough information about an individual, they have the potential to open credit cards in a person’s name, buy goods and transfer money.
Now The Yorkshire Post, teaming up with London data firm C6, reveals a picture of the booming identity trade among the criminal underworld.
The data firm has employed expert staff to track the number of identities being sold on the dark web, with people’s email addresses and names traded through encrypted chat rooms.
“As consumers we have never really paid the price for fraud,” said Emma Mills, chief operating officer of C6, which runs the hasmyidentitybeenstolen.com website.
“We’re used to the banks picking up the credit and debit card losses, we don’t see the downside to ourselves of being careless with our personal information.”
Ms Mills said the spiralling number of people at risk needs to act as a wake-up call.
“We don’t clearly understand the impact of having our identities compromised and how long and painful it is to rebuild that genuinely, it causes problems with applying for credit or any other form of account.”
The study has revealed that across Yorkshire, the details of one in six people are being offered for trade with the hardest-hit postcode being in Sheffield and Rotherham, followed by Leeds and York.
The data has been collated over a series of years by a team of cyber specialists embedded in the dark web, observing transactions through encrypted chat rooms.
Often the online marketplaces sell only partial information about an individual. One site allowed users to bulk purchase Paypal accounts for $1 per account.
The store, which also purported to sell eBay accounts, offered an 80 per cent working guarantee. On its own, a person’s streaming service account details could be seen as innocuous, Ms Mills said.
But profiles can then be ‘enriched’, often over a series of months, or even years. Once the identity is rich enough, fraudsters can open credit card accounts in a person’s name, buy goods and transfer money.
They can also sell on the so-called – “full person profile” in bulk.
DS Steve Thomas, head of crime operations at North Yorkshire Police, said many people often misunderstand how the technology they use works.
“We all sign up to new applications and contracts with new providers and don’t read the small print,” he said. “We all use location devices. If you read the small print, it says they can sell information on what you do with that device – where you shop, where you go for your morning coffee.
“At the end of the day, personal details are a commodity in a commercial world.”