Comment by streetwiseherc

Why is email/password more attractive than billing information (credit card or bank/savings account) to hackers? What's the end goal here? I would assume that it's some sort of monetary compensation? With an email and a password, you might have access to someone's banking website, but you have to guess which bank they use and you have to assume that they used the same password. It doesn't seem practical to do a massive scripted attack against a bank's website with a possible list of emails/passwords that may or may not exist on a specific bank's web site.

Now, credit card information on the other hand might be useful. There's a black market for credit card numbers, especially if they include the verification code (CSC/CVV/etc).

If hackers have access to a site's database that contains user authentication data why are we to assume that the hackers didn't have access to payment information or that they didn't have a desire to access it?