Key Points
- 72 per cent of organisations had credentials found in infostealer malware logs
- Researchers analysed 31.5 million exposed credentials across 4,824 organisations
- Financial services sector showed highest infostealer exposure at 77 per cent
Nearly three-quarters of organisations with exposed credentials had staff or customer logins identified in infostealer malware logs over a 12-month period, according to a report released by cybersecurity firm Outpost24 on 3 November 2026.
The 2026 Credential Exposure Benchmark Report analysed 31.5 million unique exposed credentials linked to 4,824 organisations across five industries in the United States and Europe.
The credentials were first detected between 1 September 2025 and 1 September 2026. Infostealers are a category of malware that harvests login credentials, browser cookies and session tokens from infected devices, allowing attackers to bypass password resets and maintain access to compromised accounts.
Of the total credentials examined, approximately 30.7 million, roughly 97 per cent, came from breach dumps and combolists, which are large collections of leaked logins that criminals compile and share online. The remaining 844,000 credentials, under 3 per cent of the total, were stolen directly from infected devices by infostealer malware. Despite their smaller share, these credentials represent a more immediate threat because they are more likely to reflect recent theft, the report said.
Among the organisations analysed, 41 per cent had at least one infostealer-sourced credential on a staff email address, suggesting malware on a device used for work. A further 31 per cent had malware-stolen credentials only on customer accounts.
Infostealer exposure
“Less than 3 per cent of exposed credentials came directly from infostealer logs, yet nearly three-quarters of organisations were affected. That tells us why counting stolen passwords isn’t enough,” said Borja Rodriguez, head of threat intelligence at Outpost24. “An infostealer doesn’t stop at one password. It can take session cookies, saved credentials and access to multiple accounts. Resetting a password may close one door while leaving others wide open.”
By the numbers
Key figures from this story- 72%
- organisations with credentials in infostealer logs
- 31.5 million
- exposed credentials analysed in study
- 77%
- financial services firms with infostealer exposure
Rodriguez added that security teams need to investigate the infection itself rather than focusing solely on the exposed credential.
The research found that exposure varies more by industry than by location. Consumer goods and services had the most exposed credentials, with 498 at the typical organisation, almost all belonging to customers. Business services ranked fourth on total credentials but first on staff exposure, with 47 per cent of organisations holding a malware-stolen staff credential. Financial services had the highest share of organisations with at least one infostealer-sourced credential, at 77 per cent.
The typical European organisation had 22 per cent more exposed credentials than its US counterpart, at 224 compared with 184. The share stolen by malware was similar in both regions.
Regional findings
Among six European regions examined, the Nordics had the highest exposure, with 358 credentials at the typical organisation and the most credentials stolen by infostealers. The UK and Ireland had the highest share stolen by malware, at 2.7 per cent. Spain had the lowest exposure, at 133 credentials at the typical organisation. The highest combination of industry and region in Europe was consumer goods and services in Benelux, at 1,285 credentials for the typical organisation.
“The company with the most exposed credentials isn’t necessarily the one with the greatest threat to its own systems,” Rodriguez said. “Thousands of stolen customer logins tell a very different story from a handful of compromised employee accounts. One points primarily to account takeover and fraud; the other could give attackers a foothold inside the business.”
The report recommends that organisations prioritise credentials stolen by infostealers and investigate the broader compromise rather than simply resetting the affected password. For staff credentials, security teams should examine the associated user and device, including whether other passwords or session cookies were stolen, and revoke active sessions. For customer credentials, organisations should secure affected accounts through password resets, additional verification and fraud monitoring.
The report references the 2024 campaign against Snowflake customers, in which attackers used stolen credentials to access accounts without multi-factor authentication. It also cites Meta, which disclosed in October 2026 that attackers had reached some of its GitHub repositories using a single employee’s stolen credentials.
Your Questions, Answered
What percentage of organisations were affected by infostealer malware?
According to the Outpost24 report, 72 per cent of organisations with exposed credentials had staff or customer logins identified in infostealer malware logs during the 12-month study period.
What is infostealer malware?
Infostealer malware harvests login credentials, browser cookies and session tokens from infected devices. This allows attackers to bypass password resets and maintain access to compromised accounts.
Which industry sector had the highest infostealer exposure?
Financial services had the highest share of organisations with at least one infostealer-sourced credential, at 77 per cent, according to the report.
How should organisations respond to infostealer-stolen credentials?
The report recommends investigating the broader compromise rather than simply resetting passwords. Security teams should examine associated users and devices, check for stolen session cookies and revoke active sessions.
