Identity-as-a-Service: Uncovering Dark Web Marketplaces Trading Executive SSNs

Rapid7 researchers have uncovered a thriving dark web identity market centered on stolen Social Security numbers of corporate executives, with three dominant marketplaces—Xilo, Bankomat, and PeopleFinder—collectively accounting for over 81% of executive SSN leaks tracked since early 2026. Since SSNs cannot be deactivated like payment cards, they retain permanent value for criminals seeking to commit identity fraud, synthetic identity schemes, and executive impersonation attacks targeting both individuals and their organizations. The research reveals that over 73% of compromised records belonged to top-level leadership, with Financial and Industrial sectors most heavily targeted, and recommends organizations implement dark web monitoring, record removal services, and enhanced verification controls to mitigate executive identity exposure.