Indian call centre staff are selling UK broadband customers' financial data, including credit card numbers and security codes, for as little as 25p each for bulk purchases.
An investigation by The Sun uncovered a former call centre worker known as Deepak Chuphal who sold the bank account details, credit card numbers and the three-digit CVV security code of 1,000 customers for £250.
CIFAS, the UK's fraud prevention service, described the news as an "absolute bombshell".
"I am astounded. The information being traded is everything a criminal needs to clear out an account or steal an identity," said CIFAS communications manager Richard Hurley.
"That this is happening on an industrial scale is enough to make anyone shudder. This is a wake-up call. Security processes and staff vetting need to be reviewed."
Chuphal claimed to have 25 contacts in nine call centres who would double their salaries by accepting bribes of £400 a month to steal the data. He could supply 5,000 British credit card numbers, 25,000 bank accounts and the personal profiles of 50,000 people a week, he said.
"Even 'soft' personal details like email addresses are massively valuable for criminals. You don't need someone's online banking password to set them up for multiple scams designed to steal money," explained Paul Vlissidis, technical director at security testers NGS Secure.
"People put their trust in banks and ISPs which will no doubt have hammered home the importance of their customers keeping passwords unique and private. But who is drilling them on their own security practices?"
The investigation broke as The Sun's owner, News International, faced questions from the House of Commons Home Affairs Select Committee over the news that the company's outsourced email contractor, Indian firm HCL Technologies, had deleted hundreds of thousands of emails on nine occasions.
The deletions were totally normal, HCL Technologies insisted, and included 200,000 "delivery failure messages" and various defunct accounts. News International had also pruned its email databases in September last year, it was revealed.
In fear of future shortage - or in preparation for its own electric car project?
New Spectre microcode patches released by Intel to fix security flaws in Skylake, Kaby Lake and Coffee Lake CPUs
But if you're running anything older you'll have to wait
Powered by servers based on Qualcomm's scalable 48-core Centriq 2400 10nm CPUs
Malware has been in circulation for more than a year