Credential Theft Statistics 2026: Infostealers, Stolen Logins & Breaches

Executive Benchmark: Credential Theft Statistics for 2026

Methodology: What Counts as a Stolen Credential?

“Credential theft statistics” is used for five different measurements. Each answers a different question, comes from a different kind of source, and can be wrong in a different way.

Source confidence. Verizon’s DBIR is a contributed incident corpus, so it says how breaches happened, not how many credentials exist. IBM’s cost data comes from breached organizations surveyed by the Ponemon Institute. Vendors such as Flashpoint, SpyCloud and Recorded Future describe what their own collection saw, and those collections overlap without being the same. Cloudflare describes traffic on its free plan. Have I Been Pwned and Shadowserver publish counts that law enforcement and sinkholes produced. Microsoft’s report describes its own telemetry and customer detections.

Counting rules used here. Every figure carries its period. A vendor’s credential count is never converted into a number of victims or breaches. When two sources report different counts for the same ecosystem, both are shown with their definitions.

Credentials in Breaches: What Verizon’s 2026 DBIR Counts

Verizon counts credentials in four ways, and each gives a different number for the same breaches.

Source: Verizon 2026 DBIR, pages 16, 29 and 36. The action figure uses n=22,624 breaches and the data figure n=19,538.

Why the 13% is not a collapse

Credential abuse fell from 22% in the 2025 DBIR to 13%. Verizon explains that it added pretexting, its second most frequent social action, to the list of initial access vectors this year. Pretexting often overlaps with credential abuse, so the addition lowered the share. On the previous definition, the 2026 value would have been 16%. Verizon also stresses that the figure covers only the first initial action it can determine, and that counting every instance of credential abuse across the breach, it still leads at 39%.

Exploitation overtook credential abuse as the first step

Exploitation of vulnerabilities was the leading initial access vector at 31%. As an action at any step, it reached 32% of breaches, doubled from 18% in the previous report. Use of stolen credentials held at 36%. Verizon notes that how attackers obtain the credentials is often unknown. They may come from phishing, infostealers or data exposed in earlier breaches and later sold.

Where the figure is highest

Among breaches in Basic Web Application Attacks, use of stolen credentials was the top action. For that pattern and for web attack volumes, see ScanTitan’s web application attack statistics.

Infostealer Statistics: Same Ecosystem, Different Counts

Infostealers are malware that harvest saved browser credentials, session cookies and other data from an infected device, then send them to the operator as a log. Four vendors and two public sources report on the ecosystem. They measure different things over different periods.

Sources: Flashpoint, SpyCloud, Recorded Future, Shadowserver statistics and Have I Been Pwned.

Three details matter for interpretation. First, Flashpoint’s 3.3 billion for 2025 is described by the vendor as a circulating inventory of credentials, cookies and tokens, not new theft in a single year, so it is not comparable with the 1.7 billion six-month figure. Second, SpyCloud’s 642.4 million credentials from 13.2 million infections and Recorded Future’s 892 million malware-log exposures describe the same year with different collections, so neither is “the” number. Third, Recorded Future found an average of 87 stolen credentials per compromised device, which is why a count of credentials is much larger than a count of victims.

Recorded Future also reported that 50% more credentials were identified in the second half of 2025 than in the first half, and 90% more in the last three months than in the first three. Of 7 million credentials with identifiable authorization URLs, 63.2% were tied to authentication systems.

Which stealers show up in Microsoft’s data

Microsoft Defender Experts reported the top five stealer families among its customers’ notifications. Atomic macOS Stealer was 50%, OtterCookie 19%, PS1Bot 14%, Lumma Stealer 10% and MacSync Stealer 7%. Microsoft noted increased macOS-targeted infostealer activity since late 2025 and said many attempted ransomware attacks are disrupted at the infostealer stage. After a user runs a malicious file, Microsoft found that malware followed in 60.3% of cases, infostealers in 12.3% and credential theft in 9.4%. Source: Microsoft Digital Defense Report 2026, pages 44 and 52.

Takedowns: Magnus, Lumma, Tycoon2FA and Endgame

Law enforcement and industry have disrupted several parts of the credential supply chain. Dates and targets are easy to blur, so they are listed here.

Sources: US Department of Justice, Microsoft on the Lumma disruption, Microsoft Digital Defense Report 2026 and Have I Been Pwned.

Have I Been Pwned loaded the Endgame data in three steps: 154,000 email addresses and more than half a million previously unseen passwords first, then 4 million addresses and 9 million passwords tied to StealC, then another 131,000 addresses, for more than 4.3 million unique email addresses in total. Shadowserver’s own statistics page lists almost 30 million StealC credentials between 4 July 2025 and 16 June 2026. These are different counts of related data, not seizures of 30 million credentials.

The Infostealer-to-Ransomware Pipeline

Verizon revisited the link between credential leaks and ransomware in 2026 with a wider dataset. It looked at ransomware victims over the previous two years and checked whether they had an infostealer or credential leak before they were publicized (n=4,395). The analysis found that 27% of ransomware victims had no associated infostealer or credential leak within the year. Of the organizations that did have one, 50% had a credential or infostealer event within 95 days before the ransomware attack.

Credential leaks also happen constantly. Small organizations in the dataset experienced a median of 7 credential leak events over the year, and larger organizations about 20. Verizon cautions that not every event leads to ransomware, but they can give attackers an easy entry that can be resold.

Ransomware appeared in 48% of breaches in the 2026 DBIR; for volumes and costs, see ScanTitan’s ransomware statistics. Among small and medium businesses, Verizon found that ransomware victims were reached through compromised credentials (38%) or unpatched vulnerabilities in edge devices (29%).

Credentials for Sale: Access Brokers and Pricing

Initial access brokers sell network access, often built from stolen credentials, to ransomware and extortion groups. Two sources describe what they sell.

Sources: Verizon 2026 DBIR, page 45, and Rapid7.

Rapid7 found that DarkForums and RAMP together accounted for 81% of observed threads, and that the United States made up 155 listings, 30.9% of the global total. It cautioned that the average price rise of about 4,055% is especially affected by DarkForums, and that victim revenue numbers are broker-provided, so they may not be accurate. Read the price as a market signal, not a standard price list. The share of RDP and VPN listings points at the same systems covered in ScanTitan’s open ports statistics.

Credential Stuffing and Password Reuse

Credential stuffing tests leaked username and password pairs against other sites. Cloudflare publishes the clearest public measure, from its free plan traffic with leaked-credential detection.

Source: Cloudflare, password reuse is rampant, published 17 March 2025. Vendor-only.

These figures describe one vendor’s network, one period and one plan tier. The 41% is a share of successful human logins, the 52% is a share of all detected authentication requests including bots, and the 95% is a share of attempts that already involved leaked passwords. They are three different denominators.

Microsoft reported a different trend in its own data: password attacks were down 26% year over year, and password spray accounted for over 99% of observed cloud initial access efforts. Microsoft attributes the decline to measures such as MFA and passkeys pushing attackers toward other approaches.

Session Theft, MFA Bypass and Passkeys

Multi-factor authentication blocks many password attacks, so attackers move to session cookies and tokens. A stolen active session can be replayed without a password or an MFA prompt.

Sources: Recorded Future, SpyCloud and Microsoft Digital Defense Report 2026, pages 45 and 64.

Two cautions apply. Recorded Future’s 36.4% and 53% describe how fast credentials were indexed by its monitoring, not how fast they appeared for sale. And Microsoft’s 44.6% is a share of phishing techniques, not a share of all session theft or MFA bypass.

Passkeys

The FIDO Alliance’s 2026 Passkey Index found that 36% of successful sign-ins on the services it monitors use a passkey, up from 26% in 2025. Passkey sign-ins succeeded 93% of the time, against 78% for traditional MFA. FIDO estimates 7 billion passkeys are in use worldwide, which counts passkeys, not accounts. The Index draws on 15 major consumer services, so it describes those services, not all workforce logins. Microsoft describes passkeys as phishing-resistant because they only work on the site or app they were created for.

How Much Does Credential Abuse Cost?

IBM’s 2026 report puts the global average cost of a breach at $4.99 million, from 602 organizations with breaches between March 2025 and February 2026.

Source: IBM Cost of a Data Breach Report 2026, pages 22 to 25. IBM lists days to identify and contain for a subset of vectors only.

IBM ranks phishing as the top attack vector for the fourth year in a row, with supply chain compromise second, followed equally by abusing valid accounts, drive-by compromise and social engineering. Valid account abuse cost $5.07 million on average, slightly less than phishing and social engineering, which IBM says suggests those attacks target credentials with access to prized data.

Credential Theft Statistics by Industry and Company Size

Verizon reports the initial access mix for each industry. Credential abuse was the first step in 8% to 15% of breaches, well below exploitation or phishing in most sectors.

Source: Verizon 2026 DBIR, industry pages 82 to 97. Each percentage is a share of that group’s breaches in the dataset, so it is not a ranking of attack frequency. For more on smaller organizations, see ScanTitan’s small business cybersecurity statistics.

Financial services had the highest credential abuse share at 15%, and small and medium businesses the highest share of breaches where credentials were among the stolen data, at 31%. Where exploitation leads, as in retail, manufacturing and the public sector, credentials still matter after entry: Verizon found that use of stolen credentials and exploited vulnerabilities each contributed to 41% of manufacturing breaches, and that stolen credentials occurred in 59% of hacking-related breaches in public administration.

Case Study: Snowflake and UNC5537

In 2024 Mandiant described a campaign against Snowflake customer database instances. Mandiant found no evidence that Snowflake’s own environment was breached. Every incident it responded to traced back to compromised customer credentials.

Source: Mandiant, UNC5537 targets Snowflake customer instances, 10 June 2024.

Mandiant noted that in several cases the infection occurred on contractor systems used for personal activity such as gaming and downloading pirated software. About 165 is the number of organizations notified as potentially exposed, not the number breached.

What the DBIR found afterward

Verizon’s 2026 report measured MFA gaps in third-party cloud environments directly. Only about 23% of organizations had fully remediated cloud MFA issues, with half resolved in roughly a month and about 32% still lingering (n=7,513). In a separate snapshot, 37% of organizations had an admin account with MFA disabled on an infrastructure-as-a-service platform, against 14% on Snowflake, which Verizon read as a sign that most customers got the message from the campaign. For weak passwords and excessive permissions in those environments, full remediation was 31% and took almost eight months.

Credential Theft Statistics Commonly Misquoted

What the Numbers Mean for a Lean Team

Verizon’s data points at a short list of controls. The record counts are too large to act on, but the mechanism is consistent: credentials are stolen, tested, sold and used within weeks.

1. Turn on phishing-resistant MFA where it is available, starting with administrators and remote access. Verizon found 37% of organizations had an admin account without MFA on an infrastructure-as-a-service platform. Microsoft and the FIDO Alliance both recommend passkeys.
2. Revoke sessions, not just passwords, after an infection. Recorded Future found 31% of malware-sourced credentials came with an active session cookie, so a reset alone may leave a stolen session valid.
3. Retire dormant accounts and rotate credentials. Mandiant’s Snowflake findings turned on credentials never rotated and no MFA. Verizon’s own control list includes disabling dormant accounts.
4. Treat personal devices that touch work as exposed. Mandiant traced several Snowflake cases to contractor machines used for gaming and downloads.
5. Reduce the doors that credentials open. Access brokers sell VPN and remote desktop access. Review what is reachable from the internet against the exposure benchmarks above, and check cloud settings against the common cloud misconfigurations list.
6. Patch exploited vulnerabilities at the same priority. Verizon found exploitation overtook credential abuse as the first step, so identity controls alone leave the other front open.

For the phishing side of credential theft, see ScanTitan’s phishing statistics. For how credentials figure in confirmed breaches overall, see data breach statistics, and for the third-party route that Snowflake illustrates, third-party data breach statistics. If a site has already been compromised, how did my website get hacked walks through finding the entry point.

How We Compiled and Verified These Statistics

• Used: Verizon’s 2026 DBIR (full report), IBM’s Cost of a Data Breach 2026 (full report), the Microsoft Digital Defense Report 2026 (full report), Mandiant’s Snowflake report, Have I Been Pwned, Shadowserver’s statistics page, the FIDO Alliance’s Passkey Index, FBI IC3 and the vendor reports from Flashpoint, SpyCloud, Recorded Future, Rapid7 and Cloudflare. Vendor figures are labeled vendor-only.
• Method: Figures were read from the primary report or page and tied to its period and unit. Cloudflare, Mandiant, Rapid7, Have I Been Pwned, SpyCloud and Recorded Future were read on their own pages. Flashpoint and FIDO figures were confirmed through the vendors’ published pages and search listings, and the Flashpoint midyear page text did not render in full.
• Excluded: Secondary summaries and blog roundups, figures that could not be traced to a primary source, and the Verizon “70%” style claims that predate the 2026 report. Several widely repeated figures were left out because they traced only to aggregator blogs, including enterprise exposure percentages and ransomware overlap percentages attributed to unnamed logs.
• Refresh: Reviewed every 90 days. Vendor reports update on their own cycles, Verizon and IBM annually, and Cloudflare’s login figures when it republishes.

How to cite this research. ScanTitan, “Credential Theft Statistics 2026: Infostealers, Stolen Logins & Breaches,” 21 October 2026. For single figures, cite the primary source beside each number.

Primary Sources

• Verizon 2026 Data Breach Investigations Report
• IBM Cost of a Data Breach Report 2026
• Microsoft Digital Defense Report 2026
• Mandiant, UNC5537 targets Snowflake customer instances
• Have I Been Pwned, Operation Endgame 4.0
• Shadowserver statistics
• US Department of Justice, Operation Magnus
• Microsoft, Lumma Stealer disruption
• FIDO Alliance Passkey Index 2026
• FBI 2025 Internet Crime Report
• Flashpoint Global Threat Intelligence Report, 2026 midyear
• SpyCloud 2026 Identity Exposure Report
• Recorded Future 2025 Identity Threat Landscape Report
• Rapid7, Initial access brokers 2026
• Cloudflare, password reuse

Frequently Asked Questions