NordVPN: ~5M people globally, including 600,000+ Indians, have had their data stolen and sold on the Genesis, Russian, and 2easy bot markets for ~$6 on average
Around five million people globally have had their data stolen and sold on the bot market till date, of which 600,000 are from India …
Context & Ripple Effects
NordVPN's researchers are mapping where breached data actually goes: not dark-web one-offs but three standing 'bot markets' — Genesis, Russian Market, and 2easy — where a victim's full digital identity changes hands for roughly $6. The report lands in a country context that keeps recurring: India has already seen the Bigbasket breach expose emails, phone numbers, and home addresses, card records sold online at scale, and a probe into a leaked COVID-vaccine portal covering over a billion recipients.
There is also an awkward self-reference here: NordVPN disclosed years ago that one of its own datacenters was hacked in March 2018, leaving it open to man-in-the-middle attacks — so the VPN vendor is now both analyst and former victim in the same stolen-data economy.
First-order effects
- Roughly 600,000 Indians whose credentials, cookies, and device fingerprints sit in these markets are exposed to account takeover and fraud at commodity pricing — about $6 per complete identity.
- Buyers get turnkey access: bot markets sell session data that defeats password resets, meaning affected users cannot fully remediate by changing passwords alone.
Second-order effects
- Indian consumer platforms keep feeding the supply side — Star Health's alleged 31M-customer dump surfaced on Telegram just as the government was already pressuring Telegram over misuse — so regulators face mounting evidence that breach data flows into resale channels within weeks.
- Security vendors gain a marketing wedge: NordVPN converting breach research into product positioning pressures rivals to publish similar telemetry or cede the 'we see the threat landscape' narrative.
Third-order effects
- If stolen identities reliably clear at single-digit prices, the economics favor industrialized breach-and-resale pipelines over bespoke hacking, pushing the burden toward identity verification and breach-liability rules rather than consumer vigilance.
- India's repeated appearance across card dumps, delivery apps, insurance leaks, and health portals points to it functioning as a structural supply hub for these markets unless enforcement shifts from takedowns to upstream breach prevention.
The trend: Stolen personal data is consolidating into low-cost, always-on bot-market storefronts, with India emerging as a recurring source geography and security vendors racing to monetize the visibility.