Online criminals stole credit-card, bank and gaming accounts over a one-year period that were potentially worth $5.3 billion, fueling a thriving underground market for consumers' identities, a Symantec Corp. study found.

Those committing fraud spent more than $276 million buying the pilfered account data, said Symantec, which is the biggest maker of security software and tracked activity between July 1, 2007, and June 30.

The scope of the thefts, carried out by loosely allied groups in North America and organized crime rings in Eastern Europe, presents challenges for law enforcement, said Symantec, which has operations in Utah. The report also spotlighted the fragmented nature of the crimes. The sellers of account information may be different from those who stole it.

The going rate for a bank, credit-card or online-gaming account can range from $10 to $1,000, depending on the account's balance, spending limit and whether it includes the user's personal-identification number and other validating information, said said Symantec's Vincent Weafer.

Stolen credit-card information represented 59 percent of all accounts advertised for sale, Weafer said.