Hacked police and government emails for sale: $40 ono
Active police and government email accounts are being sold on the dark web for as little as $40, providing cybercriminals with direct access to systems that depend on institutional trust. Research from Abnormal AI reveals that these accounts originate from agencies in the United States, United Kingdom, Germany, India, and Brazil, and are traded on underground forums. Unlike spoofed or dormant addresses, these accounts are functional and still in use by legitimate agencies. Once compromised, they enable attackers to impersonate officials, issue fraudulent subpoenas, or request sensitive data with a level of credibility that is challenging to contest.
The methods used to compromise these accounts are often straightforward. Credential stuffing and password reuse by government workers create vulnerabilities that attackers exploit. With billions of stolen credentials from previous breaches available online, cybercriminals test government email addresses against these databases to find matches. Additionally, Infostealer malware collects stored credentials from browsers and email clients, exposing accounts. Targeted phishing campaigns aimed at police or government staff can also trick victims into revealing their login details. Without Multi-Factor Authentication, a single stolen password can grant an attacker full access to the account.
