The marketplace listed 321,372 products to 18,000 users. In nine years it made 7,600 sales and $232,000

Two numbers describe the shop. A third describes the business

Ardit Kutleshi pleaded guilty on 22 September 2026 in the Western District of Pennsylvania to aggravated identity theft and money laundering conspiracy, for creating and running Rydox. His brother Jetmir pleaded guilty and was sentenced in December 2025 before being deported to Kosovo. A third administrator, Shpend Sokoli, was arrested in Albania in December 2024 and is expected to be prosecuted there.

The Justice Department has now published figures for Rydox twice: on the day of the takedown in December 2024, and on the day of the plea last week. Put them side by side and they measure two different things.

The 2024 release states that Rydox offered for sale at least 321,372 cybercrime products to over 18,000 users. The same release, two paragraphs earlier, states that the marketplace conducted over 7,600 sales and generated at least $230,000 in revenue since its inception in around February 2016. The 2026 release puts the revenue at at least $232,000 over more than 7,600 transactions.

So: 7,600 sales against 321,372 listings is at most one listing in 42, and fewer if any listing sold more than once. It is 2.4 per cent of the catalogue. Against 18,000 registered users it is 0.42 sales per account across nearly nine years. And $232,000 divided across 7,600 transactions is an average of about $30.53 a sale.

Spread over the 106 months from February 2016 to the December 2024 seizure, the entire marketplace turned over roughly $2,190 a month, before any split between the three named administrators.

There is one more figure, and it is the sharpest. In the same operation, the United States obtained judicial authorisation to seize approximately $225,000 worth of cryptocurrency from accounts controlled by the defendants. Set against the $230,000 of lifetime revenue stated in the same release, that is about 98 per cent. Nine years of proceeds were, as far as the contemporaneous filings describe, still sitting in the wallets.

What that does not establish, and this part matters more than the arithmetic. It does not establish that the harm was small. Seven thousand six hundred sales means thousands of real people's names, addresses, social security numbers, card details and account logins were sold at least once, and what a buyer does afterwards costs a great deal more than what they paid. Revenue measures the sellers' take, never the victims' loss. The US Attorney's point that these crimes cost people both money and trust stands entirely independent of the till.

It does not establish total criminal proceeds. Every figure in both releases is prefaced "at least", and the two releases differ by $2,000 on the same period, which tells you these are floors drawn from recovered evidence rather than audited accounts. It does not establish that 321,372 listings were distinct, genuine, or backed by data that existed. And it does not establish that all revenue moved through the accounts that were seized, so the 98 per cent should be read as what the filings describe rather than as a recovery rate.

What each published number actually measures

Figures as published by the Justice Department in December 2024 and September 2026. The third column is the one that is usually missing from the coverage.

Published figure	What it counts	What it does not tell you
321,372 products offered	Listings on the site at seizure	Whether any of them sold, or were real
Over 18,000 users	Registered accounts	Whether an account ever transacted
Over 7,600 sales	Completed transactions in the court record	Off-platform dealing, which is not counted
At least $232,000 revenue	Money the operators took	Anything about what victims lost downstream

Why this keeps happening, and why it is not the prosecutors' fault

The Justice Department published all four numbers. Nothing here is hidden or spun: the transaction count and the revenue appear before the catalogue size in the original release, and the 2026 release leads on transactions alone. The selection happens afterwards, in the coverage and then in the slide decks built from the coverage.

The reason is mechanical. Inventory counts are large, stable and easy to extract from a seized database. Transaction counts are smaller, require evidence for each one, and are always expressed as a floor. A headline writer choosing between 321,372 and 7,600 will take the first every time, and a threat briefing that quotes the headline inherits the choice without ever deciding to make it.

The number a governance audience should actually take away

Thirty dollars and fifty three cents.

That is the average consideration, across nine years and 7,600 transactions, for a stolen identity, a set of card details, a working login or a phishing kit on this market. It is not a precise unit price, because the catalogue mixed all of those categories together at different prices. It is the blended average of everything that sold.

If your risk model contains an assumption that acquiring your customers' personal data is expensive for an attacker, that number is the one to test it against. At $30 a record, cost is not the control. Whatever is protecting your customers' data, it is not the price of the alternative.

What to do about it

The question this leaves

There is a version of this story that reads as reassurance, and it is the wrong one. A nine year criminal marketplace that took $232,000 is not evidence that the problem is small. It is evidence that the problem is cheap, which is worse: the economics that make Rydox a poor business for its operators are the same economics that put a person's identity within reach of anyone for the price of a restaurant meal.

The operators made roughly $2,190 a month between them and lost nearly all of it. The buyers got 7,600 people's lives for about $30 each. Only one side of that trade was a bad deal.

So the question for your own reporting: the last time you put a number about criminal activity in front of a board, was it counting something that happened, or something that was merely listed?