It’s common knowledge: If account names, passwords and credit card details are stolen, they’ll eventually end up online — likely on the Dark Web for cybercriminals to share, sell and exploit. For the past two years, security firm Bitglass has been tracking the speed, type and origin of these data hacks.

According to CIO, some results were hardly surprising — attackers were more than happy to take the bait — but worth noting was the increased speed of compromise. Here’s a look at the life cycle of leaked data.

Leaked Data Is a Tempting Target

To reel in attackers, Bitglass created a high-value profile: credentials, credit card details, corporate logins and personal details for an employee at a fake financial institution. After tagging the files with a tracker and creating a realistic bank portal, the security company set their files free on the Dark Web to see what happened.

As noted by SecurityWeek, Bitglass saw five bank and three Google Drive access attempts within a day. Two days in and files were downloaded from the Drive account — one attacker even managed to crack an encrypted file. In total, the leaked data saw 1,400 visits with 1 in 10 attackers attempting Google logins. Additionally, 94 percent of those who gained Drive access uncovered the other accounts, while 36 percent successfully hacked the fake bank portal.

This year also saw a marked rise in Tor browser use. Bitglass found it was rarely used in 2015, but 68 percent of attackers used Tor this year. Of the one-third who didn’t bother protecting their IP address, the bulk of login attempts came from Russia. This suggested that despite the allure of leaked financial and personal data, “hackers are becoming more security conscious and know to mask their IPs when possible to avoid getting caught,” PCWorld quoted the security firm as stating.

Equal Opportunity?

The speed of data compromise on the Dark Web suggests a breed of attacker more sophisticated than their brute-force precursors but also speaks to a critical trend in the cybercriminal marketplace: commercialization. With even full sets of credentials now selling for less than $50, cybercriminals make profit on volume, not technological wizardry. As a result, finding leaked data first becomes top priority for malicious actors that want to get ahead of their peers.

Consider a recent TechHive article, which noted that attackers have now stepped up their attempts to steal and sell media streaming service logins. Buyers on the Dark Web can secure lifetime access to movie and TV services for less than $20. Speed marks the difference between successful criminal entrepreneur and a dismal failure; the first to the data gets paid, while everyone else gets the scraps.

So what happens if login data gets phished to the Dark Web? It’s gone. Recovery isn’t really an option — in a cutthroat cybercriminal marketplace, prevention is key to data protection.