Outpost24 released its 2026 Credential Exposure Benchmark Report. Its researchers analyzed 31.5 million unique exposed credentials linked to 4,824 organizations across five industries in the United States and Europe, first detected between September 1, 2025, and September 1, 2026. The report finds that 72% of those organizations had staff or customer credentials identified in infostealer malware logs during that period.
Around 30.7 million of the credentials, roughly 97%, came from breach dumps and combolists, large collections of leaked logins that criminals compile and share. The remaining 844,000, under 3%, were stolen from infected devices by infostealer malware and are far more likely to reflect recent theft. Of the organizations analyzed, 41% had at least one infostealer-sourced credential on a staff email address, suggesting malware on a device used for work. A further 31% had malware-stolen credentials only on customer accounts.
“Less than 3% of exposed credentials came directly from infostealer logs, yet nearly three-quarters of organizations were affected. That tells us why counting stolen passwords isn’t enough,” said Borja Rodriguez, Head of Threat Intelligence at Outpost24. “An infostealer doesn’t stop at one password. It can take session cookies, saved credentials and access to multiple accounts. Resetting a password may close one door while leaving others wide open. Security teams need to investigate the infection, not just the exposed credential.”
The research found that exposure varies far more by industry than by location. Consumer Goods and Services had the most exposed credentials, 498 at the typical organization, almost all belonging to customers. Business Services ranked fourth on total credentials but first on staff exposure, with 47% of organizations holding a malware-stolen staff credential. Financial Services had the highest share of organizations with at least one infostealer-sourced credential, at 77%.
The typical European organization had 22% more exposed credentials than its US counterpart, 224 compared with 184. The share stolen by malware was similar in both.
Of the six European regions, the Nordics had the highest exposure, with 358 credentials at the typical organization, and the most credentials stolen by infostealers. The UK and Ireland had the highest share stolen by malware, at 2.7%. Spain had the lowest exposure, at 133 credentials at the typical organization. The highest combination of industry and region in Europe was Consumer Goods and Services in Benelux, at 1,285 credentials for the typical organization.
“The company with the most exposed credentials isn’t necessarily the one with the greatest threat to its own systems,” Rodriguez added. “Thousands of stolen customer logins tell a very different story from a handful of compromised employee accounts. One points primarily to account takeover and fraud; the other could give attackers a foothold inside the business. Security teams need to know whose credentials were stolen, not just how many.”
The report recommends prioritizing credentials stolen by infostealers and investigating the wider compromise, rather than simply resetting the affected password. For staff credentials, security teams should investigate the associated user and device, including whether other passwords or session cookies were stolen, and revoke active sessions. For customer credentials, organizations should secure affected accounts through password resets, additional verification and fraud monitoring.
The report revisits the 2024 campaign against Snowflake customers, in which attackers used stolen credentials to log in to accounts without multi-factor authentication. It also points to Meta, which disclosed in October 2026 that attackers had reached some of its GitHub repositories using a single employee’s stolen credentials.
The full report is available at https://outpost24.com/resources/2026-credential-exposure-benchmark-report/.
