"Ten of thousands" of identity details belonging to British people are up for sale on the Dark Web for less than £20 each, according to reports.
And security bosses say the problem may be even worse, telling the Financial Times the personal details of more than 600,000 customers were stolen from UK companies last year.
The average cost for a set of details - including bank account information - is around $30, or £19.60.
Profiles containing data from the government's own systems - including information shared by HMRC and the Department for Work and Pensions - are considered the "Crown jewels" of identities, the officials said, and have been recently available for as little as $75 (£49).
The government is now looking into whether tighter regulations concerning online security need to be drawn up, a spokesman said, adding that ministers had invested more than £860 million in cyber security to date.
It comes after phone and broadband provider TalkTalk was hacked last week, with customers' bank account numbers and sort codes among the information feared stolen.
Information security company Symantec said it knew of at least 609,239 individuals' personal data stolen from UK-based companies in 2014 - part of 358m stolen worldwide.