How is a price put on a stolen database? Presumably whatever a criminal is willing to pay, which is based on the value they can extract from the personal records through some form of fraud.