Over the past few decades, the issue of stolen data has expanded from a nuisance caused by few opportunistic individuals to a thriving, highly organised, and profitable economy. As such, it spawned a thread of research trying to document and understand the underground economy. We look back at the past 15 years of research on stolen data markets to uncover the underlying patterns and trends, documented by researchers. We examine the economy and find a changing landscape, both in terms of popular stolen data types as well as the platforms housing the marketplaces. Additionally, we record a consistent decrease in market lifespans and as well as observation periods. We highlight a number of research patterns and potential shortcomings, in particular the low coverage of markets included in research and the low diversity of languages featured in the marketplaces. Finally, we propose a number of directions for future research to better understand the true cost of the economy and the mismatch between data breaches and data appearing on markets. Future research will also need to stay on top of the changing landscape and focus on timely identification of new trends and community movements across platforms.

The GDPR has been in force since 2018, but there is still uncertainty about how to comply with several of its provisions, including Article 32 which sets forth the requirements for data security. While scholars in this field have previously analysed the law or the industry standards, we use the fines imposed so far for violation of Article 32 as our primary data. We annotate and analyse technical and legal aspects of a representative subset of cases. Using clustering, four groups of cases with distinct characteristics emerge from our research. Three of the four groups of cases suffer from data incidents, but for different reasons: a targeted attack, non-technical human mistakes, or a combination of mistakes. The final group includes cases where no actual data incident happened, but fines were still imposed due to insufficient organisational measures and high risk or imminent harm to the data subjects. We uncover from the cases different measures that apply to each of the groups, ranging from compliance with the highest industry standards to organisational measures and enhanced internal privacy awareness.