Cybercriminals claim to be selling the Social Security numbers of babies on the dark web.
The personal details of children — including dates of birth and mother’s maiden names — have been sought after for years. Now, researchers have found an ad on a forum for the sale of data claiming to be from infants.
The cost: $300 worth of bitcoin for each baby’s data set.
An infant’s personal information can provide cybercriminals access to a clean credit history. This can be used to take out mortgages, apply for credit cards or receive government benefits.
Because child identity theft schemes can go undetected for years, often until they’re old enough to open up a credit card account, their data is considered especially valuable.
The ad read “get em befor tax seson [sic]” — a nod to the busiest time of year for identity theft.
It was posted on a dark web marketplace only accessible through software called Tor. The dark web refers to networks of websites that require specific software to access. Some dark web sites are known for criminal activity.
On some dark web forums, cybercriminals can take classes on how to steal credit card data. Members of these forums also sell “fullz,” a slang term for full sets of people’s personal information.
The listing for infant data was discovered by researchers at Terbium Labs, a dark web intelligence firm. The cost and age of the alleged victims came as a surprise to Emily Wilson, the company’s director of analysis.
Although the firm has seen child data for sale before, this was the first time it has seen infants’ data for sale.
“It’s unusual to have information specifically marked as belonging to children or to infants on these markets,” Wilson said.
The interest is not surprising. According to a 2011 report from Carnegie Mellon University’s CyLab, the rate of child identity theft is 51 times higher than for adults (whose data sets cost about $10 – $25 on dark web markets).
Identity theft can have a lingering effect on a child’s financial history.
Christina Warren — a former reporter who now works for a large tech company — was about 12-years-old when she started receiving credit card bills. After collection notices piled up, her parents had to convince creditors her identity had been stolen.
Credit reporting agencies said they fixed the issue, but she later had trouble getting her first credit card.
“It was a massive headache,” Warren told CNN Tech. “I didn’t realize until six years later that it was still ongoing.”
Even now, Warren, 35, doesn’t know how her identity was stolen. Before the internet became a playground for hackers, low-tech methods included mail theft, burglary, phone scams or taking advantage of lost or stolen wallets, said Eva Velasquez, president and CEO of the Identity Theft Resource Center.
Now, it’s easier than ever for criminals to steal personal data, thanks largely to the growth of sophisticated phishing attempts, major data breaches and more credit card applications and taxes filed online. In 2017, the Equifax breach alone exposed Social Security numbers and other personal information of more than 145 million people.
Lisa Schifferle, an attorney with the FTC’s Division of Consumer and Business Education, said Social Security numbers are the main component of child identity theft.
“It [doesn’t always have to be in] in the child’s name,” Schifferle said. “Sometimes thieves use Social Security numbers in connection with a made-up name or their own name.”
When personal data is dumped online, it takes only a few minutes before people try to exploit it, according to a FTC report conducted last year.
The FTC currently provides resources for parents who think a child’s identity may have been stolen, and tips for keeping their information safe, starting from the time he or she is a baby.
Velasquez said parents should keep an eye out for signs that their child’s information has been stolen. This may include receiving an alert when a Social Security number has credit history when you file your taxes or if a child is receiving a jury summons.
After numerous phone calls and verifying documentation, Warren and her parents eventually straightened out the issue.
“[One thing I learned is to] keep documentation and paperwork for everything,” said Warren, noting identity theft victims may be asked to prove the situation was sorted.
