Data as an asset: a new factor of production, with Chinese characteristics

China has become the world’s biggest generator of data, thanks to 1.1bn internet users and state initiatives in digital control. According to The Economist, the authorities are turning information into a key resource alongside labour, capital and land.

Facial-recognition infrastructure and a centralised market for personal information are being embedded not only in the economy but also in national security. The approach is both a challenge and a lesson for democracies.

President Xi Jinping has called data a key resource that could radically shape global competition. He says the vision spans a wide range of domains—from civil rights to tech firms’ revenues and China’s ambitions in artificial intelligence.

Policy is following suit. In 2021 China issued rules modelled on Europe’s General Data Protection Regulation (GDPR). It is now moving away from Western norms.

A large project is under way to analyse big datasets in state-owned firms. The idea is to value them as assets, put them on balance sheets or trade them on national exchanges. On June 3rd the State Council unveiled new rules mandating information-sharing across all levels of government.

Another piece of the mosaic is a digital identifier due to launch on July 15th. It will let the central government control the registry of each person’s websites and apps.

It will become harder for large tech firms, which previously managed the system, to link identities to online activity. They will see only an anonymised stream of numbers and letters.

China’s apparent end-goal is a “national ocean of data” spanning consumers, industry and the state, the newspaper noted.

Potential advantages include cheaper training of AI models and lower barriers to entry for small new firms. The downside is inefficient centralised management of information.

Shanghai police previously lost 1bn records to hackers: names, addresses, birthplaces, national IDs, phone numbers, criminal files and more. The database was listed for sale at 10 BTC. Per person the sum is tiny—mere cents for a full dossier.

The new system could supplant existing online monitoring, where low-level law-enforcement officers often exceed their authority.

What are data worth?

Personal data form a vast market spanning multiple domains:

• passport and identification data;
• phone numbers and contact details;
• accounts: email, passwords;
• bank accounts;
• medical information;
• biometric data;
• addresses, tax and insurance numbers.

Because of weak security at private companies and government bodies, information on tens or even hundreds of millions of people is available online.

China’s underground trade

A stable price structure has emerged on the black market for different categories of personal data. Prices vary widely—from a few dollars for social-media accounts to thousands for access to bank accounts or closed databases. Owing to leaks and insider dealing, information on Chinese citizens has become accessible and cheap, especially for everyday look-ups.

In many cases sellers obtain confidential data by recruiting insiders at Chinese surveillance agencies and state contractors, then resell access online to buyers with few questions asked. The result, emerges an ecosystem where, for a small sum, anyone can request phone numbers, bank details, hotel bookings, flight records or even the location of a target. Payments are made in cryptocurrencies.

Because scans of passports and driving licences are abundant, their prices on dark-web markets are low. For example, a copy of a Russian ID together with a TIN sells for about 100 rubles. A bundle of several documents can be bought for 300 rubles. By comparison, on international marketplaces the average price of a US passport scan is about $50, and a Russian one roughly $80.

Criminals often sell not a single file but a full set of personal data. It may include name, date of birth, address, document numbers (passport, driving licence), tax and social identifiers, bank details and more. Such dossiers are especially valuable because they can be used immediately for identity theft, taking out loans and other schemes. In 2024 the price of one set on the black market ranged from $20 to $100 and higher.

In China’s underworld, services provide access to official data. By recruiting insiders in state bodies, intermediaries sell registry look-ups—for a few dollars, for instance, a history of registered addresses or marital records. For larger sums one can buy scans of documents such as passports or driving licences.

Such “online look-ups” effectively monetise the state surveillance system. Researchers note that Chinese channels openly post adverts for cooperation with employees of the Ministry of Public Security, civil administration, banks and other institutions. For access to data they promise rewards of up to 70,000 yuan a day (about $10,000). This points to strong underground demand for personal information even within the country.

Contact data (mobile numbers, emails, postal addresses) often leak in bulk and are sold wholesale. Because such details are of limited value on their own, large lists are cheap. For example, a dump of hundreds of thousands of email addresses can sell for just $10. In 2018 dark-web marketplaces offered some 200m records with Chinese citizens’ personal information (including ~130m customers of the Huazhu hotel chain).

Oversupply has pushed down prices for contact data. In 2014 a basic set of information about a person averaged $4; by 2025 it was just $1.

Far more valuable than a phone number itself is the ability to obtain information about it quickly—say, the owner’s name, current or past locations, or call records. In the Russian internet there are Telegram bots and private “suppliers” who charge from 2,000 rubles for a one-off phone look-up. In China, underground services offer similar data for just a few dollars.

One study found that in a Chinese Telegram channel you could pay the equivalent of $50–100 to learn all bank accounts registered to a specific phone number, linked services such as WeChat and Alipay, and even the subscriber’s recent geolocation data.

Logins and passwords

Compromised accounts for popular services are widely available on the black market. Prices depend on the account’s importance (number of followers, linked payments, and so on).

According to Privacy Affairs, a hacked Gmail account sells for about $60 on average, while Facebook or Instagram accounts go for about $25. Low prices reflect the scale of breaches: millions of stolen logins and passwords are in circulation.

Less common or more privileged accounts cost more—for example, a hacked Uber driver account at roughly $30, and a “boosted” Airbnb account at around $300.

Financial data

Even basic information such as a card number, CVV, expiry date and cardholder name can be put up for sale, albeit cheaply if it comes from old leaks. On underground forums a stolen credit-card number may cost about $3. A full card dataset with a balance of up to $5,000 is priced at roughly $110–120.

Direct access to online banking is pricier. Accounts with small balances (up to about $1,000) may sell for $200–500, and those with large balances for $1,000 or more. Fully verified accounts at payment systems and crypto exchanges cost hundreds of dollars: a hacked Revolut account at about $1,600, Kraken at about $1,170, Coinbase at $250.

Healthcare

Medical data are among the most sensitive—and command high prices on the black market. Electronic medical records include not only personal details but also medical histories, test results and insurance data. Such information can be used for fraud or blackmail. By estimates, one medical record on the dark web sells for about $250 on average, and in some cases reaches $500–1,000.

The average “market” price of a medical record in 2024 was around $60. A US Social Security number sold for $15, and credit-card data for $3.

This shows that health information is valued several times higher than “ordinary” data. The head of Qualys stressed that a medical-data leak is “much worse than most others,” and cybercriminals know it.

Biometrics

Demand for biometric identifiers picked up in 2025. Where once passwords and documents dominated, criminals now hunt what cannot be changed: fingerprints, facial templates, voice samples, iris scans.

On specialist forums, sets of stolen biometric data are already for sale: for example, a full set of fingerprints for just $3–5, and a digitised facial template (for recognition systems) for $5–10 per record.

Biometric data linked to a financial account—fingerprints, facial photos and voice—can cost from $25 to $100.

Addresses

Other personal data on the black market include home addresses, dates of birth, tax identifiers (for example, TIN, SNILS, SSN), insurance-policy numbers, employment and education details, and so on. Most often these data are sold as part of the categories already discussed—database leaks, full dossiers or document bundles.

Basic personal data without financial details—for instance client lists with names, addresses, emails and phone numbers—are cheap: about $5–15 per person.

Government databases (for example, voter rolls, vehicle registries, taxpayer lists) also regularly surface on underground resources. Prices vary by freshness and volume. A voter database from one American state was offered for about $100; similar lists have sometimes been posted for free.

A Chinese dystopia

Many countries are trying to fix data governance. According to The Economist, the Trump administration may consider hiring the private technology firm Palantir to consolidate government information. The EU may have to update the GDPR. India’s Aadhaar identification system emphasises privacy at the expense of potential economic growth.

In democracies it is harder to build a large, effective data-governance system: it must balance checks and balances and protect property rights, privacy and civil liberties.

China can devote less attention to such concerns and build an efficient, dystopian surveillance system. For decades it was a “fast follower” of Western innovation. If it now showcases the financial value of its “national ocean of data”, its method of centralisation will pose not only an economic but also a political challenge.

In March 2025, after the surge in popularity of DeepSeek’s AI models, some employees of the startup had their passports seized and were barred from leaving the country freely.