A rapid increase in cyberattacks targeting major Australian companies means countless phone numbers, passwords, email addresses, driver’s licences, passport details or even street addresses are in the hands of malicious hackers.

Once your valuable data has been accessed by a cybercriminal, there’s no controlling where it might end up.

And you are powerless to remove it.

“Once it’s on the dark web, it rarely stays in the hands of just one cybercriminal,” McGee said.

“Often, it changes hands multiple times. One attacker might buy the data to commit identity theft, while another might use it to craft convincing phishing campaigns.”

This means victims of a cyberbreach could be repeatedly targeted by scams, McGee explained.

The value of your information is determined by a few factors, including how much there is, how recently it was stolen and how it can be used.

According to cybersecurity firm Enovise Group, credit card information can be bought for as little as $7.

Medical records are the most valuable stolen data.

A complete medical profile might sell for $380 to $1500 since criminals can use it to perpetrate insurance fraud, buy prescription medicines and even create false medical identities.

Cybersecurity strategist and Dartrace vice president Tony Jarvis said hackers may also hold private details for ransom before deciding to turn to the dark web.

Large companies with deep pockets face a high risk of data blackmail.

Cybercriminals extorted a record $1.7 billion in ransom payments from victim organisations around the world in 2023. 

“Getting the data is the first step, but then there’s using the data for their own revenue,” Jarvis said.

“That could be as simple as going back to the organisation the attacker has just impacted and saying, ‘I’ve got your data, either you pay me a ransom or I’m going to encrypt your files, I’m going to put it out up on the internet, you’re going to be financially impacted, and your reputation is going to be impacted. 

Jarvis said the dark web, which hosts a roaring trade of personal information, is the most common place stolen data will end up.

“It’s basically a market where people will bid or make offers on that data and people will ultimately buy it,” Jarvis said.

“It’s a little bit cloak and dagger. It’s not an open market.”

Law enforcement agencies are working overtime to shut down criminal marketplaces on the dark web.

“Combating cybercrime is a key part of our efforts to stay ahead of serious criminal threats to Australia and Australians,” the Australian Federal Police said.

“We work to disrupt anonymous cybercriminals who are using the dark web to evade detection.”

In 2024, the federal government passed the Cyber Security Act in a bid to strengthen cybersecurity across public and private sectors.

It included a reporting obligation of ransomware attacks or ransomware payments and the establishment of a Cyber Incident Review Board.

Jarvis tempered fears that your identity will permanently be at risk if you’ve been impacted by a cyberattack.

Instead, he urged cautiousness and said changing passwords is the safest way to mitigate the damage.

And if you suspect your details have been compromised, don’t simply wait for an email alerting you to a breach.

Jarvis said act fast before you can’t undo a lot of the damage.

“And if you use that same password on anything else, go and change that as well,” Jarvis said.

McGee also warned information can’t be taken off the dark web, but you can “review credit statements and reports, change account passwords, and use caution with suspicious emails” to minimise access for malicious hackers.

Both expect more ransomware and cyberattacks will be perpetrated against organisations big and small in Australia despite investment in cybersecurity.

But McGee said the biggest cause is human error.

“In terms of weak spots, the number one cause of breaches is still human error, with employees falling for sophisticated and usually very convincing phishing emails or social engineering attacks,” he added.

“Other causes include third-party suppliers with weaker defences, unpatched systems and legacy applications and credential reuse where stolen passwords still work for companies that don’t have strong authentication policies.”