No reliable evidence proves that prices for stolen health records are falling. The figures often compared come from different years, products, markets and measurement methods. A 2019 estimate put the mean at $250 (up to $1,000), while later sources variously cite about $60 for a single electronic health record (EHR), a $250 account offer and roughly $300 for personal health data. Those numbers cannot be read as a like-for-like price series.
Why a falling-price claim is unproven
A trend requires comparable observations: the same kind of data, measured in the same way, across multiple dates. The available publications do not provide that. They mix estimated averages, broad ranges, vendor-compiled figures and individual observed offers.
They also use different units. An EHR, a complete patient record, an individual account and an aggregated category called personal health data may contain very different information and have different uses to criminals. An asking price or observed listing is not proof that a buyer completed a transaction at that amount.
Consequently, the published numbers show that health data has been assigned substantial value at different times, but they do not establish a decline, increase or stable market-clearing price.
Recommended Free Tools
#1 Best Overall
Published estimates side by side
| Publication | Unit described | Figure | What the source measured |
|---|---|---|---|
| HHS Cybersecurity Coordination Center, 2019 | Health record on criminal markets | $250 estimated mean; up to $1,000 | Historical estimate in a briefing, not a reported series of completed sales |
| IBM X-Force, 2022 | Healthcare record | About $250 | IBM’s article statement; the cited passage does not describe a contemporaneous transaction sample |
| Trellix, 2025 report | Single EHR | Approximately $60 | General statement in the report; the passage does not provide enough detail to normalize it against other figures |
| Trellix, reporting an observation from late 2023 | Compromised account | $250 per account | An observed threat-actor offer, distinct from Trellix’s general EHR figure |
| U.S. Senate report 118-280, 2025 | Health records | $250–$1,000 | A range cited from secondary reporting, not a Senate market study |
| Flare, 2026 | Personal health data | About $300; one analysis gives $300.30 | Vendor estimate compiled from 348 PII price points, not a universal market-clearing price |
The table contains apparent movement in both directions. The $60 EHR figure is below older $250 estimates, but Flare’s roughly $300 estimate is higher, and Trellix separately observed a $250 account offer. Without common definitions and sampling, arithmetic comparisons would be misleading.
What makes medical information valuable to criminals?
Health information can combine names, dates of birth, addresses, insurance details, diagnoses, provider information and billing data. IBM and other security sources describe it as persistent: unlike a password, many medical facts cannot simply be changed after exposure. Criminals may use combinations of health and identity data for insurance or billing fraud, account takeover, impersonation, targeted scams or to support other fraudulent applications.
That persistence and the possibility of several types of misuse help explain why analysts call health data valuable. They do not establish that any particular listing sold for a particular amount. A data set’s completeness, freshness, exclusivity and proof of access can affect an offer, as can the reputation of the seller and the market where it appears.
Why the sources cannot be turned into a price chart
Different products
“Medical record,” “EHR,” “compromised account” and “personal health data” are not interchangeable labels. One source may mean a record containing clinical and billing fields; another may mean credentials that provide access to a system; a compiled category may combine many types of personally identifiable information.
Free tools Windows power users keep installed
One-click scans. No signup required.
Different kinds of numbers
- Estimated mean: HHS’s $250 figure is an historical average estimate, with values reported as high as $1,000.
- Range: The Senate report’s $250–$1,000 passage repeats a range from secondary reporting.
- Observed offer: Trellix’s $250 figure was an offer it observed for a compromised account in late 2023.
- Compiled estimate: Flare’s approximately $300 (including $300.30 in one article) was derived from 348 collected price points.
- Article-level statement: IBM’s approximately $250 figure is presented in its 2022 article, without a transaction sample in the cited passage.
Different markets and missing context
Sources do not consistently specify geography, access conditions, record completeness, seller reputation, volume discounts, currency treatment or whether a listing remained available. TrendAI’s June 9, 2026 release describes an underground economy spanning marketplaces, forums, ransomware leak sites, access brokers and fraud markets. It analyzed 7,779 forum posts, 21,813 marketplace listings and 95 leak sites over 12 months, but it did not publish a comparable health-record price series. A large collection of listings is therefore not the same thing as a longitudinal price index.
Do other “medical record” prices answer the question?
No. A 2020 academic study of marketplace listings examined prices for fake medical records used in COVID-related schemes. Fake documents are a different product from stolen patient records, so those observations should not be folded into a trend for real health-record data.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What people should do after a health-data exposure
Price uncertainty does not reduce the need to respond to a breach notice. The following measures can limit some downstream damage:
- Use a unique password for every affected service, and change any other account that reused the exposed password.
- Turn on multifactor authentication wherever the provider offers it, prioritizing email, financial and health-portal accounts.
- Monitor financial accounts and statements for unfamiliar claims, charges, transfers or account changes.
- Consider a credit freeze with the major credit bureaus if identity information, such as a government identifier, was exposed.
- Report suspected identity theft through the U.S. government’s IdentityTheft.gov service and follow the provider’s breach-specific instructions.
These steps can make some forms of misuse harder, but they cannot guarantee that copied records are removed from criminal systems or that reposted data will disappear.
Bottom line on “prices are dropping”
The reviewed evidence does not verify a decline. Historical estimates near $250 and as high as $1,000 sit alongside Trellix’s approximately $60 single-EHR statement, its separate $250 observed account offer and Flare’s roughly $300 personal-health-data estimate. Because the units and methods differ, the defensible conclusion is that no comparable time series is available—not that dark-web health-record prices are falling.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
