![\"Ciberseguridad](\"https:\/\/metamedia.cloud\/wp-content\/uploads\/2026\/08\/el-negocio-del-hacking-ciberseguridad-empresas-metamedia.jpg\")
<\/figure>\nData is the new digital gold (and it comes with a list price)<\/h2>\n
On dark web markets, stolen data is traded just like any other commodity. An analysis by the firm Flare of hundreds of real listings published between 2008 and 2026 puts the figures into perspective:<\/p>\n
- \n
- Complete medical record:<\/strong> About 300 USD. It's the most expensive option on the market.<\/li>\n
- Bank account number:<\/strong> about 69 USD.<\/li>\n
- Passport:<\/strong> about 33 USD.<\/li>\n
- Credit card number:<\/strong> about 17 USD.<\/li>\n
- Email address:<\/strong> less than $1.<\/li>\n<\/ul>\n
Why is a medical record worth twenty times more than a credit card? Because a credit card can be canceled in five minutes, and the bank issues a new one. Your medical history, medical conditions, and personal information are never canceled. They can be used for insurance fraud, fake prescriptions, and identity theft for decades.<\/p>\n
And the scale is massive: KELA identified nearly 2,860 million compromised credentials circulating through criminal channels in 2025 alone, most of which were stolen by malware of the infostealer<\/em>. The practical conclusion is uncomfortable but clear: A correct username and password are no longer proof of identity<\/strong>. If your access system still works that way, it's a generation behind the market that's targeting you.<\/p>\n
Story 1: Lazarus and Bybit's $1.5 billion<\/h2>\n
On February 21, 2025, the cryptocurrency exchange Bybit lost approximately 1,500 million dollars worth of Ethereum\u2014more than 400,000 ETH and stETH\u2014in what is considered the largest cryptocurrency theft in history. The The FBI attributed the attack to the Lazarus group<\/a>, also known as TraderTraitor or APT38, linked to the North Korean government.<\/p>\n
Here's the detail that almost no one explains properly: Bybit was not hacked<\/strong>. They compromised the computer of a developer at Safe Wallet, the provider of the multi-signature platform that Bybit was using. With that access, they manipulated the process so that Bybit\u2019s signers would approve\u2014believing it to be legitimate\u2014a transaction that sent the funds to wallets controlled by the attackers. They then converted the loot into bitcoin and dispersed it among thousands of addresses.<\/p>\n
In other words: The weak link was in the supply chain<\/strong>, not at the target company. It\u2019s the same pattern we see in Mexican SMEs. They don\u2019t attack your server\u2014they attack the external accountant\u2019s laptop, the FTP access of the programmer who built your website three years ago, or that administrator account you gave to the previous agency and never revoked.<\/p>\n
Regarding the role of the \u201cinsider\u201d: the pattern actually documented in North Korea is not bribing bank executives, but rather infiltrate remote IT workers using fake identities<\/strong> in Western companies\u2014something for which the U.S. Department of Justice has filed several charges. Legitimate access remains the best intrusion tool available.<\/p>\n
The case is still ongoing: Bybit filed a lawsuit against North Korea, its intelligence agency RGB, and the Lazarus Group in federal court in Washington, D.C., and obtained a preliminary order to freeze assets. According to Chainalysis, North Korean hackers have accumulated approximately $6.75 billion in stolen cryptocurrency.<\/p>\n
Story 2: Malone Lam, 4,100 bitcoins, and a call from \u201cGoogle Support\u201d<\/h2>\n
On August 18, 2024, Malone Lam (20, a Singaporean citizen) and Jeandiel Serrano (21) contacted a victim in Washington, D.C. They posed as technical support staff from Google and the Gemini exchange, alerting the victim to an alleged security breach in their account. By the end of the call, they had gained access to more than 4,100 bitcoins\u2014worth about $230 million at the time\u2014making it one of the largest thefts from a single person in U.S. history.<\/p>\n
Zero exploits. Zero sophisticated malware. A phone conversation and a well-rehearsed script.<\/strong><\/p>\n
What followed reveals the level of organization: the U.S. Attorney\u2019s Office prosecuted the case under the RICO Act\u2014which is used against organized crime\u2014with 17 defendants and a structured division of labor: hackers, \u201ccallers\u201d who made the calls, target identifiers, physical thieves, and money launderers.<\/p>\n
In a related incident, a member of the organization traveled to New Mexico to break into another victim\u2019s home and steal his hardware wallet, while Lam tracked his location by logging into his iCloud account. The money was spent on Lamborghinis, watches, and $500,000-a-night bills at nightclubs. As of May 2026, Lam had yet to be sentenced, and nine co-defendants had already pleaded guilty.<\/p>\n
The pattern: Vulnerability isn't technical\u2014it's human<\/h2>\n
One heist of 1.5 billion and another of 230 million. One backed by the government and the other by a group of kids who met on Discord. And both started the same way: a person who trusted at the wrong time<\/strong>. A developer whose computer had been compromised. An investor who answered the phone.<\/p>\n
In Mexico, the situation is no different\u2014just less glamorous. The country ended 2025 as one of the most targeted in Latin America, with more than 35,200 million cyberattack attempts recorded in the first quarter alone, according to Fortinet\u2019s FortiGuard Labs. There are three most common attack vectors targeting Mexican companies, and none of them are unusual: phishing, exposed remote desktop (RDP), and unpatched VPN<\/strong>. Add to that the new wave of AI-cloned voice scams in which scammers impersonate executives to authorize transfers\u2014a threat PwC Mexico has already warned about.<\/p>\n
The statistic that matters most to us as operators: according to the Verizon's DBIR report<\/a>, 54% of the ransomware victims had their credentials circulating in infostealer logs prior to the attack<\/strong>. If you want to gauge the economic impact, check out our analysis on How much does a cyberattack cost a company in Mexico?<\/a>. Data theft doesn't start on the day of the theft. It starts months earlier, when someone installed something they shouldn't have.<\/p>\n
Six Cybersecurity Measures for Businesses That Actually Work (and How We Implement Them at Metamedia Cloud)<\/h2>\n
1. Treat your cell phone for what it is: your most critical device<\/h3>\n
- Bank account number:<\/strong> about 69 USD.<\/li>\n