By Ehtijad Ali
Updated: October 2026
Reading time: about 12 minutes
What is an initial access broker? It is a criminal who breaks into a company’s computer network and then sells that way in to other criminals. The buyer may then steal data, demand money, or launch a ransomware attack.
Imagine a criminal who wants to attack a company but does not know how to get inside. Instead of breaking in alone, they can simply buy a way in from someone who already found one.
This guide explains, in simple words, what these brokers sell, how much they charge, how they get in, and how businesses can stop them. New to these terms? Our dark web glossary explains them in plain language.
Table of Contents
What is an initial access broker?
An initial access broker, often called an IAB, is a cybercriminal who gets into a computer network and sells that access to someone else. They focus on one job only: the first step, getting inside.
Think of a big office building. One criminal finds a way past the front door. Instead of stealing anything, they sell a copy of the key to another criminal. The second criminal then decides what to do inside.
A computer network works in a similar way. The “key” might be a work account, a remote login, or a hidden foothold inside the company’s systems. The buyer can use it to reach more computers or steal important files.
What do initial access brokers sell?
Brokers sell unauthorized entry into computer systems. Not every sale is the same. The price depends on what the buyer can reach and how much control they get.
- Stolen logins: Usernames and passwords for a business account.
- Remote access: Entry to the tools workers use to connect to the office from home.
- Employee accounts: Accounts that open work email, shared files, or other company services.
- Admin-level access: Powerful accounts that can control more users or computers.
Some brokers claim their access reaches many systems or comes with powerful permissions. But a criminal’s claim is not proof. Sellers often exaggerate.
Still, research shows many listings are serious. Security company Rapid7 reported in August 2025 that 71.4% of the access listings it studied offered some level of extra control, not just a basic login. You can read the Rapid7 access broker research for details.
How much do initial access brokers charge?
There is no fixed price. It depends on the company, the type of access, and how much control comes with it.
In Rapid7’s 2025 study, nearly 40% of the listings were priced between $500 and $1,000. The average price was just over $2,700. That is a shockingly small amount compared to the damage an attack can cause.
Keep in mind these numbers come from one study. They are not a price list for every seller.
| What may affect the price | Why it matters |
|---|---|
| Size of the business | A bigger company may have more valuable data and systems. |
| Type of access | A basic account is worth less than access with full control. |
| Industry | Some businesses hold data or run services that criminals want most. |
| How trusted the seller is | Buyers check if the seller’s claims seem real. |
For deeper research, see Flare’s report on initial access brokers and underground markets. Many of these sales happen on hidden forums. Learn more about those places in our guide to what is on the dark web.
How the cybercrime “supply chain” works
Today, a single cyberattack can involve several criminals, each doing a different job. It works a bit like a factory line.
- Breaking in: A criminal finds a way into a company’s system.
- Selling access: The initial access broker sells that way in.
- Taking over: The buyer uses the access to move deeper, if it still works.
- Stealing or locking data: The next group copies files or uses ransomware to lock them.
- Demanding money: Criminals ask for payment, or threaten to leak the stolen files.
Not every attack follows these exact steps. Some attackers do everything themselves, and some sold access is never used. To see every job inside a ransomware group, read how ransomware gangs work.
Why are the break-in and the attack separate jobs?
Breaking into a network and running a full attack need different skills. One person may be good at finding weak security. Another may be good at ransomware or stealing files.
By selling access, the first criminal gets paid quickly without doing the risky part. The buyer saves time because they start with a door that is already open.
This split lets criminal groups attack more companies. It also means a business may be attacked by a brand-new group, even if the person who first broke in is long gone.
Europol’s 2025 Internet Organised Crime Threat Assessment explains how stolen data, access brokers, and criminal markets fit together.
How do initial access brokers get in?
There is no single trick. Security reports describe several common paths:
- Stolen passwords: Taken by harmful software or leaked in a data breach. A common tool is infostealer malware.
- Phishing: A worker is tricked into giving away a password or opening a bad file.
- Stolen login cookies: These can let criminals skip the password. Learn how session hijacking works.
- Weak remote access: Poorly protected remote login tools can be an easy entry point.
- Old software: Programs that are not updated may have known security holes.
- Unsafe account settings: Old accounts, no second login step, or too many permissions.
These are risks to check and fix. They do not prove a company has been attacked. For more context, see the Flare guide to initial access brokers.
Stolen logins have even been sold on whole criminal markets. Genesis Market, for example, sold logins from more than 1.5 million hacked computers before police shut it down. Read about it in our guide to major dark web takedowns.
Initial access brokers vs. ransomware groups
These two are connected, but they are not the same thing.
| Initial access broker | Ransomware group or affiliate |
|---|---|
| Gets unauthorized access to a network. | Uses that access to launch a ransomware attack. |
| May sell the access to another criminal. | May lock files or threaten to leak stolen data. |
| Focuses on the first way in. | Focuses on the next stage of the attack. |
Some groups do more than one job. Others work with partners. In a model called ransomware-as-a-service (RaaS), one group builds the ransomware and “rents” it to others, called affiliates.
A real case: selling access to company networks
In May 2024, the US Department of Justice announced charges in an access broker case. Prosecutors said a man broke into computer networks and offered that access for sale on a cybercrime forum.
Remember, charges are only accusations. A person is innocent unless proven guilty in court. You can read the US Department of Justice case announcement to see how this kind of crime works.
Warning signs that your access may be for sale
A company may never see the sale itself. But there are clues that someone may already have a way in:
- Logins from strange places or at odd hours.
- New user accounts that nobody remembers creating.
- Many failed login attempts, followed by one that works.
- Security tools being turned off without a reason.
- Alerts that a work email and password appeared in a data breach.
If you see any of these, act fast. Change the affected passwords, sign out all sessions, and ask an IT or security expert to check the network.
How businesses can protect themselves
Companies cannot stop criminals from trying. But they can make breaking in much harder, and make strange activity easier to spot.
- Turn on multi-factor authentication (MFA): Add a second check to email, remote access, and admin accounts.
- Use a different password for every account: A password manager makes this easy.
- Update software: Install security updates for computers, apps, and remote access tools quickly.
- Remove old accounts: Close accounts for former workers and contractors.
- Limit permissions: Give each person only the access they need for their job.
- Watch for unusual activity: Check strange logins, account changes, and remote connections.
- Keep safe backups: Store protected backups and test that you can restore them. Here is why backups alone may not be enough against ransomware.
- Have a plan: Decide ahead of time who will investigate, cut off affected systems, and call for help.
For practical advice, see CISA Secure Our World and the CISA StopRansomware resources.
What every worker can do
You do not have to be in IT to help. Many break-ins start with one person’s account. Here is how anyone can help keep the door shut:
- Never reuse your work password on other websites.
- Approve a login request on your phone only if you just tried to sign in yourself.
- Report strange emails or texts to your IT team instead of deleting them quietly.
- Lock your computer when you walk away.
- Tell IT right away if you think you clicked a bad link. Speed matters more than blame.
These same habits protect your personal accounts too. Start with the most important privacy settings to change today.
Frequently asked questions
What is an initial access broker in simple words?
An initial access broker is a criminal who breaks into a company’s computer network and sells that way in to other criminals, who then carry out the attack.
Are initial access brokers hackers?
Yes. They are criminals who get into computer systems without permission and sell that access. Their methods and skill levels can be very different.
Do initial access brokers always work with ransomware gangs?
No. Ransomware gangs are common buyers, but stolen access can also be used for data theft, fraud, spying, or other crimes.
Does a stolen password mean my business has been hacked?
Not always. A stolen password is a risk, but it does not prove someone logged in. Change the password, turn on multi-factor authentication, and check recent account activity.
Can a small business be a target?
Yes. Small businesses often hold useful customer data and may have less security. Every business should protect its accounts, devices, and backups.
How can a company know if its access is being sold?
Often it cannot know for sure. Security monitoring and trusted threat-intelligence services can spot leaked accounts or signs of a break-in, but none can find every listing. Investigate anything suspicious quickly.
Helpful links and sources
This article uses public information from police, security researchers, and government cyber safety agencies.
- US Department of Justice: access broker case
- Rapid7: 2025 access broker research
- Flare: underground corporate access research
- Europol: Internet Organised Crime Threat Assessment 2025
- CISA: Secure Our World
- CISA: StopRansomware
- DeepHiDX: Dark web timeline
- DeepHiDX: Sources and research policy
The short version
An initial access broker is a criminal who breaks into a computer network and sells that access to someone else. The buyer may steal data, commit fraud, or launch a ransomware attack.
Because the work is split between different criminals, attacks are easier to carry out. That is why businesses should not wait until their files are locked. Protect important accounts, turn on multi-factor authentication, update software, limit permissions, and watch for anything unusual.
Comments