The Price of Secrets: How Data and IP Fuel the Underground Market

In today’s hyperconnected economy, data and intellectual property (IP) are the crown jewels of nearly every industry. Whether it’s a pharmaceutical formula, a semiconductor design, or a trove of customer records, these assets represent competitive advantage, national security leverage, and direct financial value. Because of this, they attract a wide spectrum of adversaries; from nation-states and organized cybercriminals to insiders and opportunistic hackers.

This post explores who is after data and IP across industries, what they target, how much it’s worth (legally and illegally), and what happens once it’s stolen or acquired. By mapping motivations, valuations, and exploitation pathways, organizations can better understand the threat landscape and prioritize defenses where they matter most.

Who targets data and IP

Actor Type	Primary Motivation	Typical Targets	Telltale Tactics
Nation-state actors	Strategic, economic, defense advantage	Defense tech; semiconductors; telecom; biotech; AI models	Spearphishing; supply-chain compromise; custom malware; long-term persistence
Corporate espionage / competitors	Market advantage; faster time-to-market	R&D docs; roadmaps; pricing; customer lists	Insider recruitment; targeted phishing; acquisition of contractors
Cybercriminal gangs	Fast financial return	Financial data; PII; credentials; source code; exploitable IP	Ransomware; data exfiltration; ransomware + leak sites; access-as-a-service
Insider threats (disgruntled / poached)	Personal gain, revenge, leverage	Source code; client lists; trade secrets	Unauthorized downloads; USB/cloud exfil; privilege misuse
Supply-chain attackers / vendors	Indirect access to many victims	Build systems; firmware; libraries; vendor IP	Compromised updates; trojanized components; vendor account takeover
Industrial spies / patent opportunists	Monetize via copying or litigation	Prototypes; lab notes; process IP	Physical theft; covert hires; procurement infiltration
Opportunistic hackers / gray-market buyers	Low-entry resale, data aggregation	PII, credentials, lower-tier IP	Mass scraping; public data reassembly; commodity scams

Typical values: legal markets vs illicit markets

Asset Type	Legal Market Value (range)	Illicit Market Value (range)	Key pricing drivers
Personal Identifiable Information (per full record)	$0.50–$150	$0.50–$50	Completeness, country, verification, linkage to financial accounts
Payment card data (usable)	Not legally sold	$5–$200 per card	Card type, BIN, issuer, CNP usability, freshness
Validated credentials	N/A	$1–$500 per account	Privilege level, access scope, 2FA presence
Source code / software IP	$10k–$millions	$1k–$250k per significant repo	Uniqueness, ability to compile/run, commercial applicability
Biotech / drug formulas	$100k–$many millions	$10k–$500k	Development stage, regulatory progress, experimental validation
Semiconductor design / hardware IP	$100k–$100M+	$10k–$5M	Manufacturability, yield secrets, integration complexity
Customer lists / B2B leads	$50–$5k per list	$10–$2k	Industry, freshness, contract status, verified contacts
Trade secrets / processes	Company valuation-dependent	$5k–$10M+	Competitive impact, reproducibility, revenue linkage

Notes: Illicit values are volatile, often negotiated, and depend on exclusivity, validation, and buyer profile. Strategic acquisitions by state actors may bypass monetary exchange.

How stolen or acquired data/IP is used

Direct resale: Packaged and sold on dark markets or to brokers; exclusivity and validation increase price.
Fraud and identity abuse: PII and card data used for fraud, synthetic IDs, or account takeovers.
Ransom and extortion: Threaten to publish IP, customer data, or leak source code to extract payment.
Competitive acceleration: Competitors or spies use stolen R&D, designs, or roadmaps to accelerate products or undercut pricing.
Weaponization: Nation-states integrate stolen knowledge into military programs or offensive cyber capabilities.
Counterfeiting: Hardware and firmware IP enable counterfeit production and supply-chain poisoning.
Patent and litigation schemes: Use proprietary details to file opportunistic patents or craft litigation leverage.
Long-term espionage: Maintain persistent access for ongoing intelligence—procurement, hiring, and roadmap monitoring.
Data enrichment/profiling: Fuse multiple datasets to create high-value profiles for fraud rings or surveillance.
Brokered resale: Sell assets onward to specialized buyers (state, corporate spy, criminal syndicate).

Monetization lifecycle and channels

Discovery and access
- Techniques: scanning, targeted phishing, supply-chain compromise, insider recruitment, credential stuffing.
Validation and enrichment
- Verify credentials, test cards, probe accounts, combine data sets to raise market value.
Segmentation and packaging
- Create niche products: admin accounts, high-value repos, verified full, industry-specific IP bundles.
Sales channels
- Public dark markets; invite-only forums; private brokers; direct sales to state actors; extortion via leak sites.
Downstream exploitation
- Immediate fraud, product imitation, long-term intelligence, extortion, counterfeiting, or research acceleration.
Cash-out and laundering
- Crypto payments, money mules, layered conversions, and integration into legitimate marketplaces when possible.

Industry-specific drivers and examples

Technology and Software
- Targets: source code, algorithms, model weights, dev secrets, vulnerability disclosures.
- Why: reproducing code/model reduces R&D time; exploits broaden attack surface.
- Actors: nation-states, competitors, crime gangs selling 0-days.
Semiconductor and Hardware
- Targets: mask sets, layouts, process parameters, firmware.
- Why: domestic production, defense advantage, counterfeit or backdoored chips.
- Actors: nation-states, supply-chain attackers, counterfeiters.
Biotech and Pharma
- Targets: compound formulas, clinical data, genomic datasets, CRO notebooks.
- Why: enormous commercial upside; ability to shortcut or bootstrap research.
- Actors: states, corporate spies, insiders at CROs or labs.
Financial Services
- Targets: customer PII, transaction logs, trading algorithms, payment gateways.
- Why: immediate financial theft, market manipulation, insider trading intelligence.
- Actors: criminal gangs, insiders, state actors for economic influence.
Defense and Aerospace
- Targets: classified designs, avionics software, procurement schedules.
- Why: national security advantage, asymmetric warfare development.
- Actors: nation-states, contractor insiders, advanced persistent threat groups.
Manufacturing and Energy
- Targets: process IP, SCADA/ICS designs, supply manifests, maintenance schedules.
- Why: sabotage, extortion, counterfeit parts, operational disruption.
- Actors: states, industrial spies, criminals pursuing extortion.
Retail and Consumer
- Targets: POS card data, loyalty program DBs, transaction histories.
- Why: card fraud, targeted scams, resale of lists.
- Actors: opportunistic gangs and fraud rings.

High-value signals and detection indicators

Large, unusual outbound transfers from dev/build environments or artifact repositories.
New privileged accounts or privilege escalations outside normal change windows.
Bulk downloads or archive exports of repositories, documentation, or dataset buckets.
Access to IP stores from foreign or unexpected IP ranges and vendor accounts.
Sudden vendor or contractor access surges, or anomalous update activity in third-party components.
Unexplained hardware or firmware changes on supply-chain devices.
Targeted social engineering of employees with R&D or procurement access.

Prioritized mitigations

Asset inventory and classification
- Map code, designs, datasets, and their business criticality. Tag owners and access rights.
Least privilege and just-in-time access
- Remove standing privileges; use ephemeral credentials and time-limited access for builds and deployments.
Data loss prevention and exfiltration controls
- Endpoint DLP, cloud egress controls, sensitive-repo monitoring, and anomaly detection on exports.
Secure software supply chain
- SBOMs, signed artifacts, reproducible builds, vetted dependencies, and registry monitoring.
DevSecOps and CI/CD hardening
- Protect pipelines, artifact stores, and keys; require code reviews and provenance for builds.
Insider risk program
- Combine HR processes, behavioral analytics, targeted audits, rigorous offboarding, and contract controls.
Encryption and compartmentalization
- Encrypt at rest/in transit; compartmentalize sensitive datasets and apply split-knowledge where feasible.
Detection focused on IP stores
- Monitor source control, ticketing systems, cloud buckets, and artifact repositories for abnormal patterns.
Incident and extortion playbooks
- Predefine legal, PR, and technical steps; prepare containment, disclosure, and law-enforcement coordination.
Commercial and legal measures

NDA enforcement, expedited patent filings, escrow for critical IP, and supplier security requirements.

Quick, valuation-driven guidance

Prioritize controls where illicit value and business impact align: semiconductor design, unique source code that drives differentiation, and late-stage biotech data.
For high-volume PII risks, emphasize detection and fraud-integration (credential stuffing monitoring, MFA, rapid takedown) over full prevention.
Treat supply-chain compromise as existential: require artifact signing, vendor SLAs, SBOMs, and reproducible builds.
Use combined controls: technical (DLP, JIT access), people (insider programs), and commercial/legal (NDAs, escrow) to reduce both likelihood and impact.

Closing

The pursuit of data and IP is not random, it is systematic, motivated, and highly profitable. Nation-states seek long-term strategic advantage, competitors aim to leapfrog innovation cycles, and cybercriminals monetize whatever they can quickly resell or extort. The value of these assets is measured not only in black-market prices but also in the strategic disruption, competitive acceleration, and reputational damage they can cause.

For defenders, the lesson is clear: treat data and IP as core business assets, not just IT artifacts. That means classifying them, monitoring them, and protecting them with the same rigor as financial capital or physical infrastructure. By aligning security investment with the true market and strategic value of these assets, organizations can shift from reactive defense to proactive resilience.

David