Mass data breaches have grabbed media attention over the last decade, ranging from the TJX breach in 2007 to the most recent compromise of Target and Neiman Marcus. The academic research community from both the social and technical sciences are increasingly focused on the activities of data thieves and the market for data resale that has emerged in forums and IRC. These studies have varying depth of content and representativeness, creating a great deal of speculation about the profit margins and economy for stolen data. In fact, Herley and Florencio argue that open forums for stolen data are largely "lemon markets" in that the data sold is invalid or will lead a buyer to be ripped off rather than receive product. Any cost estimates derived from such an analysis are likely to be invalid and reflect the practices of unscrupulous vendors rather than demonstrate the activities of sophisticated and "legitimate markets." This presentation will explore whether lemon markets exist, using qualitative and quantitative analyses of a sample of threads from 13 Russian and English language forums involved in the sale of stolen data. Estimates for the prices for data sold in the markets will be provided, along with an examination of the social and market forces that shape the advertised prices for certain products. The policy implications of this study for consumers, law enforcement, and security analysts will be discussed in depth to provide improved mechanisms for the disruption and takedown of stolen data markets globally.