You have probably heard that identity thieves want your credit card numbers and Social Security information. What you may not know is that your medical records are far more valuable to criminals than either of those. On the digital black market, a complete medical record commands prices ranging from $260 to more than $300 per record — roughly ten times what a stolen credit card fetches. The theft of medical data has become one of the most profitable enterprises in modern cybercrime, and understanding why can help you grasp the true stakes of healthcare data breaches.
The Scale of the Problem
The numbers are staggering. In 2024 alone, over 276 million Americans — approximately 81 percent of the entire U.S. population — had their protected health information exposed in data breaches. That marked a 64 percent increase from 2023, itself a record-setting year. Since 2020, more than 590 million medical records have been compromised in the United States, meaning the average American has likely had their data stolen more than once. Healthcare has ranked as the most expensive sector for data breaches for fourteen consecutive years, with the average breach now costing affected organizations $9.8 million — more than double the average for financial services companies.
What Makes Medical Data So Valuable
The core reason medical records command such high prices is permanence. When a thief steals your credit card number, your bank cancels the card within hours. The information becomes useless almost immediately. Medical records contain something no institution can cancel or reissue: your immutable identity. Your date of birth, your Social Security number, your blood type, your diagnosis history, and your insurance policy information will follow you for the rest of your life. Criminals refer to this quality as “durable exploitation value,” meaning they can return to the same stolen record for years or even decades and find it still useful.
A complete medical record typically includes your full legal name, date of birth, Social Security number, home address, insurance policy numbers, employer information, and detailed clinical data such as diagnoses, medications, and treatment histories. Bundled together, this information gives a scammer almost everything they need to impersonate you across multiple systems simultaneously.
The Many Ways Scammers Profit
Once a criminal acquires your medical records, the income streams available to them are varied and compounding.
Insurance fraud is among the most lucrative applications. A thief who knows your insurance policy number, your provider, and your medical history can file fraudulent claims for procedures, equipment, and medications that were never provided to you. Your insurer pays out, and you may not discover the fraud for months — sometimes only when you are billed for a service you never received, denied coverage because your benefits appear exhausted, or contacted by a debt collection agency.
Prescription fraud presents another direct avenue for profit. Armed with your identity and medical background, a criminal can obtain controlled substances or expensive medications in your name. They may use this information to visit multiple pharmacies, to create convincing forged prescriptions, or to sell the medications on the black market. Scammers who understand your medical conditions can request medications that your records suggest you might plausibly need, making the fraud harder for pharmacists to detect.
Government benefit fraud exploits programs such as Medicare and Medicaid. A criminal can submit claims to these programs using your identity, collecting reimbursements for medical services, equipment, and drugs that were never actually provided. In a 2025 national enforcement action, the Justice Department charged 324 defendants with submitting more than $14.6 billion in fraudulent healthcare claims, many of which relied on the stolen identities of over one million Americans.
Ransomware and extortion represent a different but equally profitable category. Rather than monetizing individual records, criminal groups such as BlackCat, RansomHub, and the recently emerged PEAR group attack healthcare institutions directly, encrypt their data, and demand payment in exchange for a decryption key. Hospitals and healthcare systems are particularly vulnerable because they cannot afford prolonged outages — patients’ lives may depend on immediate access to records. This coercive dynamic gives attackers enormous leverage. The 2024 ransomware attack on Change Healthcare, which processed roughly 40 percent of all U.S. medical claims, disrupted pharmacy and insurance billing systems nationwide for weeks, affected the data of approximately 190 million individuals, and resulted in a $22 million ransom payment.
Personal extortion is a growing tactic made possible when stolen records contain sensitive diagnoses. A criminal in possession of information about a person’s mental health treatment, substance use history, HIV status, or other stigmatized conditions can threaten to expose that information to employers, family members, or the public unless the victim pays. Unlike financial fraud, this form of exploitation targets a person’s reputation and privacy directly, and victims often have no institutional recourse.
Synthetic identity fraud allows criminals to combine your real medical information with fabricated details to create new, fictitious identities that they then use to apply for credit, loans, and government benefits. Artificial intelligence has accelerated this practice significantly, with synthetic identity fraud increasing by roughly 27 percent following the widespread adoption of AI tools.
Why Healthcare Organizations Are Easy Targets
Criminals pursue medical records not only because the data is valuable but because healthcare organizations are comparatively easy to breach. Many hospitals and clinics operate on legacy software systems that lack modern security controls. The industry depends heavily on third-party vendors such as billing companies, transcription services, and insurance processors, each of which represents an additional point of vulnerability. The average healthcare data breach goes undetected for 93 days after it begins, and the full breach lifecycle — from initial intrusion to containment — averages 213 days. That extended window gives criminals months to monetize stolen data before any institution or individual can respond.
The Asymmetry of Consequences
For a scammer, stealing medical records is a high-reward, relatively low-risk activity. A single successful breach of a mid-sized healthcare provider can yield tens of thousands of complete records, each saleable for hundreds of dollars on dark web marketplaces or directly exploitable for insurance and government benefit fraud. For the victim, the consequences are far harder to escape. Correcting fraudulent entries in medical records is a lengthy, technically complicated process. Erroneous diagnoses or treatments recorded under your name can affect your insurance premiums, your life insurance eligibility, and in serious cases, the medical care you receive in the future if a clinician acts on inaccurate information.
What You Can Do
Request copies of your medical records regularly and review them for treatments, medications, or procedures you do not recognize. Check your Explanation of Benefits statements from your insurer carefully after any medical encounter. Consider placing a credit freeze with the major credit bureaus to limit a thief’s ability to open new accounts in your name. If you believe your medical identity has been compromised, contact your insurer, your healthcare providers, and the U.S. Department of Health and Human Services, which maintains a public list of providers whose records have been exposed in breaches affecting 500 or more patients.
Medical identity theft moves slowly and silently compared to financial fraud. By the time most victims discover that their records have been stolen and exploited, the damage has already compounded across multiple systems. Understanding the economics behind this crime is the first step toward taking it seriously.
