Credential attack statistics 2026
As of November 2026: Phishing was the first step in 16% of breaches in Verizon's 2026 DBIR, and APWG counted 1,069,681 phishing attacks in Q2 2026 alone. Microsoft says more than 97% of identity attacks are password attacks, and Cloudflare found 41% of successful human logins used leaked passwords. Infostealers keep the supply flowing: Flashpoint recorded 1.7 billion stolen credentials in the first half of 2026, and Recorded Future found 31% of malware-sourced credentials carried live session cookies.
Phishing and AiTM kits
- 16%
Phishing was the initial access vector in 16% of breaches in Verizon's 2026 DBIR, unchanged from the previous year.
Source: Verizon, 2026 Data Breach Investigations Report, published May 19, 2026
Method: Analysis of more than 31,000 real-world security incidents, of which more than 22,000 were confirmed data breaches in 145 countries, mostly occurring in 2025. Last checked 2026-11-05.
How to cite
Verizon, "2026 Data Breach Investigations Report," May 19, 2026, https://www.verizon.com/business/resources/T343/reports/2026-dbir-data-breach-investigations-report.pdf. Compiled in Start with Identity, "Credential attack statistics 2026," https://startwithidentity.com/statistics/credential-attacks/#credential-attacks-dbir-phishing-initial-access (checked 2026-11-05).
- 40%
In Verizon's phishing simulation data, the median click rate for mobile-centric lures such as voice and text messages was 40% higher than for email.
Source: Verizon, 2026 Data Breach Investigations Report, published May 19, 2026
Method: Phishing simulation campaign data from DBIR contributors, analyzed in the 2026 Data Breach Investigations Report. Last checked 2026-11-05.
How to cite
Verizon, "2026 Data Breach Investigations Report," May 19, 2026, https://www.verizon.com/business/resources/T343/reports/2026-dbir-data-breach-investigations-report.pdf. Compiled in Start with Identity, "Credential attack statistics 2026," https://startwithidentity.com/statistics/credential-attacks/#credential-attacks-dbir-mobile-lure-click-rate (checked 2026-11-05).
- 1.4%
The median click rate of email phishing simulation campaigns in Verizon's 2026 DBIR was 1.4%, against close to 2% for phone-centric simulations.
Source: Verizon, 2026 Data Breach Investigations Report, published May 19, 2026
Method: Phishing simulation campaign data from DBIR contributors, analyzed in the 2026 Data Breach Investigations Report. Last checked 2026-11-05.
How to cite
Verizon, "2026 Data Breach Investigations Report," May 19, 2026, https://www.verizon.com/business/resources/T343/reports/2026-dbir-data-breach-investigations-report.pdf. Compiled in Start with Identity, "Credential attack statistics 2026," https://startwithidentity.com/statistics/credential-attacks/#credential-attacks-dbir-email-simulation-click-rate (checked 2026-11-05).
- 80%
Plain phishing made up 80% of the attacks blocked by email security gateways in Verizon's 2026 DBIR data, ahead of malware emails at 10% and callback lures at 5%.
Source: Verizon, 2026 Data Breach Investigations Report, published May 19, 2026
Method: Email security gateway data from DBIR contributors, analyzed in the 2026 Data Breach Investigations Report. Last checked 2026-11-05.
How to cite
Verizon, "2026 Data Breach Investigations Report," May 19, 2026, https://www.verizon.com/business/resources/T343/reports/2026-dbir-data-breach-investigations-report.pdf. Compiled in Start with Identity, "Credential attack statistics 2026," https://startwithidentity.com/statistics/credential-attacks/#credential-attacks-dbir-email-gateway-plain-phishing (checked 2026-11-05).
- 1,069,681
APWG counted 1,069,681 phishing attacks in the second quarter of 2026, up 10.1 percent from 971,181 in the first quarter.
Source: APWG, Phishing Activity Trends Report, 2nd Quarter 2026, published August 28, 2026
Method: Count of unique phishing sites reported to APWG by members and the public and through the APWG eCrime eXchange, April to June 2026. Last checked 2026-11-05.
How to cite
APWG, "Phishing Activity Trends Report, 2nd Quarter 2026," August 28, 2026, https://docs.apwg.org/reports/apwg_trends_report_q2_2026.pdf. Compiled in Start with Identity, "Credential attack statistics 2026," https://startwithidentity.com/statistics/credential-attacks/#credential-attacks-apwg-q2-2026-phishing-attacks (checked 2026-11-05).
- 87.7%
In Microsoft's 2026 reporting period, 87.7% of phishing intrusions involved credential or session harvesting, as adversary-in-the-middle kits displaced plain URL and attachment lures.
Source: Microsoft, Microsoft Digital Defense Report 2026, published October 2026
Method: Microsoft Defender Experts customer notifications on phishing intrusions, July 2025 through June 2026. Last checked 2026-11-05.
How to cite
Microsoft, "Microsoft Digital Defense Report 2026," October 2026, https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2026-v1.1.pdf. Compiled in Start with Identity, "Credential attack statistics 2026," https://startwithidentity.com/statistics/credential-attacks/#credential-attacks-microsoft-phishing-credential-harvesting (checked 2026-11-05).
- 6%
Email phishing was the initial infection vector in 6% of Mandiant investigations in 2025, down from 14% in 2024, while voice phishing rose to second place.
Source: Mandiant (Google Cloud), M-Trends 2026 Executive Edition, published March 23, 2026
Method: Mandiant Consulting investigations of targeted attack activity conducted between January 1, 2025 and December 31, 2025. Last checked 2026-11-05.
How to cite
Mandiant (Google Cloud), "M-Trends 2026 Executive Edition," March 23, 2026, https://services.google.com/fh/files/misc/m-trends-2026-executive-edition-en.pdf. Compiled in Start with Identity, "Credential attack statistics 2026," https://startwithidentity.com/statistics/credential-attacks/#credential-attacks-mtrends-email-phishing-decline (checked 2026-11-05).
- 28.6 million
SpyCloud recaptured 28.6 million phished identity records in 2025, and nearly half belonged to corporate users.
Source: SpyCloud, New SpyCloud Report Highlights Surge in Exposed API Keys, Session Tokens, and Machine Identities, published March 19, 2026
Method: SpyCloud analysis of stolen credential and identity data it recaptured from criminal underground sources during 2025. Last checked 2026-11-05.
How to cite
SpyCloud, "New SpyCloud Report Highlights Surge in Exposed API Keys, Session Tokens, and Machine Identities," March 19, 2026, https://spycloud.com/newsroom/annual-identity-exposure-report-2026. Compiled in Start with Identity, "Credential attack statistics 2026," https://startwithidentity.com/statistics/credential-attacks/#credential-attacks-spycloud-phished-identities (checked 2026-11-05).
Vishing and help desk attacks
- 502%
Weekly confirmed malicious voice phishing over cross-tenant Microsoft Teams calls rose 502% year over year, according to the Microsoft Digital Defense Report 2026.
Source: Microsoft, Microsoft Digital Defense Report 2026, published October 2026
Method: Microsoft Threat Intelligence telemetry on cross-tenant Teams calls during the July 2025 to June 2026 reporting period. Last checked 2026-11-05.
How to cite
Microsoft, "Microsoft Digital Defense Report 2026," October 2026, https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2026-v1.1.pdf. Compiled in Start with Identity, "Credential attack statistics 2026," https://startwithidentity.com/statistics/credential-attacks/#credential-attacks-microsoft-teams-vishing-growth (checked 2026-11-05).
- 93%
In the Teams vishing attacks Microsoft studied, 93% of attackers kept at least one target on the line for 20 seconds or longer, and 48% of all calls passed that mark.
Source: Microsoft, Microsoft Digital Defense Report 2026, published October 2026
Method: Microsoft Threat Intelligence telemetry on vishing calls over Microsoft Teams during the July 2025 to June 2026 reporting period. Last checked 2026-11-05.
How to cite
Microsoft, "Microsoft Digital Defense Report 2026," October 2026, https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2026-v1.1.pdf. Compiled in Start with Identity, "Credential attack statistics 2026," https://startwithidentity.com/statistics/credential-attacks/#credential-attacks-microsoft-vishing-engagement (checked 2026-11-05).
- 20%
Voice phishing detected by APWG member Crane Authentication increased by 20% from Q1 to Q2 2026, while SMS phishing increased by 40 percent.
Source: APWG, Phishing Activity Trends Report, 2nd Quarter 2026, published August 28, 2026
Method: Phishing and telephone fraud detections by APWG founding member Crane Authentication, reported in APWG's Q2 2026 trends report. Last checked 2026-11-05.
How to cite
APWG, "Phishing Activity Trends Report, 2nd Quarter 2026," August 28, 2026, https://docs.apwg.org/reports/apwg_trends_report_q2_2026.pdf. Compiled in Start with Identity, "Credential attack statistics 2026," https://startwithidentity.com/statistics/credential-attacks/#credential-attacks-apwg-vishing-growth (checked 2026-11-05).
Password attacks and credential stuffing
- 32%
Identity-based attacks surged by 32% in the first half of 2025, according to the Microsoft Digital Defense Report 2025.
Source: Microsoft, Microsoft Digital Defense Report 2025, published October 16, 2025
Method: Microsoft telemetry from more than 100 trillion daily signals, including 38 million identity risk detections a day, covering July 2024 through June 2025. Last checked 2026-11-05.
How to cite
Microsoft, "Microsoft Digital Defense Report 2025," October 16, 2025, https://blogs.microsoft.com/on-the-issues/2025/10/16/mddr-2025/. Compiled in Start with Identity, "Credential attack statistics 2026," https://startwithidentity.com/statistics/credential-attacks/#credential-attacks-microsoft-identity-attacks-surge (checked 2026-11-05).
- 18.4%
Of intrusions that began with valid accounts in Microsoft's 2026 reporting period, 18.4% involved active password spray campaigns and 52.2% involved follow-on credential theft.
Source: Microsoft, Microsoft Digital Defense Report 2026, published October 2026
Method: Microsoft Defender Experts customer notifications on initial access techniques, July 2025 through June 2026. Last checked 2026-11-05.
How to cite
Microsoft, "Microsoft Digital Defense Report 2026," October 2026, https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2026-v1.1.pdf. Compiled in Start with Identity, "Credential attack statistics 2026," https://startwithidentity.com/statistics/credential-attacks/#credential-attacks-microsoft-password-spray-valid-accounts (checked 2026-11-05).
- 41%
About 41% of successful human logins to websites protected by Cloudflare involved leaked passwords, based on traffic from September to November 2024.
Source: Cloudflare, Password reuse is rampant: nearly half of observed user logins are compromised, published March 17, 2025
Method: Cloudflare leaked credentials detection telemetry from login traffic to websites protected by Cloudflare between September and November 2024, checked against a database of over 15 billion leaked records. Last checked 2026-11-05.
How to cite
Cloudflare, "Password reuse is rampant: nearly half of observed user logins are compromised," March 17, 2025, https://blog.cloudflare.com/password-reuse-rampant-half-user-logins-compromised/. Compiled in Start with Identity, "Credential attack statistics 2026," https://startwithidentity.com/statistics/credential-attacks/#credential-attacks-cloudflare-leaked-password-logins (checked 2026-11-05).
- 95%
Bots made 95% of the login attempts that used leaked passwords on Cloudflare-protected sites, a sign of credential stuffing at scale.
Source: Cloudflare, Password reuse is rampant: nearly half of observed user logins are compromised, published March 17, 2025
Method: Cloudflare leaked credentials detection telemetry from login traffic to websites protected by Cloudflare between September and November 2024, checked against a database of over 15 billion leaked records. Last checked 2026-11-05.
How to cite
Cloudflare, "Password reuse is rampant: nearly half of observed user logins are compromised," March 17, 2025, https://blog.cloudflare.com/password-reuse-rampant-half-user-logins-compromised/. Compiled in Start with Identity, "Credential attack statistics 2026," https://startwithidentity.com/statistics/credential-attacks/#credential-attacks-cloudflare-bot-leaked-logins (checked 2026-11-05).
- 1,957,476,021
Have I Been Pwned loaded 1,957,476,021 unique email addresses and 1.3 billion unique passwords from Synthient's credential stuffing threat data, its largest corpus to date.
Source: Have I Been Pwned (Troy Hunt), 2 Billion Email Addresses Were Exposed, and We Indexed Them All in Have I Been Pwned, published November 5, 2025
Method: Count of unique email addresses in credential stuffing lists that Synthient collected from locations where criminals published them and shared with Have I Been Pwned. Last checked 2026-11-05.
How to cite
Have I Been Pwned (Troy Hunt), "2 Billion Email Addresses Were Exposed, and We Indexed Them All in Have I Been Pwned," November 5, 2025, https://www.troyhunt.com/2-billion-email-addresses-were-exposed-and-we-indexed-them-all-in-have-i-been-pwned/. Compiled in Start with Identity, "Credential attack statistics 2026," https://startwithidentity.com/statistics/credential-attacks/#credential-attacks-hibp-synthient-credential-stuffing (checked 2026-11-05).
- 5.3 billion
SpyCloud recaptured 5.3 billion stolen username or email and password pairs in 2025, and 80% of exposed corporate credentials contained plaintext passwords.
Source: SpyCloud, New SpyCloud Report Highlights Surge in Exposed API Keys, Session Tokens, and Machine Identities, published March 19, 2026
Method: SpyCloud analysis of stolen credential and identity data it recaptured from criminal underground sources during 2025. Last checked 2026-11-05.
How to cite
SpyCloud, "New SpyCloud Report Highlights Surge in Exposed API Keys, Session Tokens, and Machine Identities," March 19, 2026, https://spycloud.com/newsroom/annual-identity-exposure-report-2026. Compiled in Start with Identity, "Credential attack statistics 2026," https://startwithidentity.com/statistics/credential-attacks/#credential-attacks-spycloud-credential-pairs (checked 2026-11-05).
Infostealers and session cookie theft
- 1.7 billion
Flashpoint recorded 1.7 billion credentials stolen by infostealer malware from 7.4 million infected hosts and devices between January and June 2026.
Source: Flashpoint, Global Threat Intelligence Report 2026: Info-stealing Malware, published August 4, 2026
Method: Flashpoint monitoring of over thirty active infostealer families, illicit marketplaces, Telegram channels and bot shops from January 1, 2026 to June 30, 2026. Last checked 2026-11-05.
How to cite
Flashpoint, "Global Threat Intelligence Report 2026: Info-stealing Malware," August 4, 2026, https://flashpoint.io/resources/report/flashpoint-global-threat-intelligence-report-midyear-2026/information-stealing-malware-threats/. Compiled in Start with Identity, "Credential attack statistics 2026," https://startwithidentity.com/statistics/credential-attacks/#credential-attacks-flashpoint-infostealer-credentials (checked 2026-11-05).
- 63.2%
Of 7 million stolen credentials with identifiable authorization URLs that Recorded Future indexed in 2025, 63.2% were tied to authentication systems.
Source: Recorded Future, 2025 Identity Threat Landscape Report: Inside the Infostealer Economy, published March 2026
Method: Credentials indexed by Recorded Future's Identity Intelligence module across calendar year 2025 from the open web, dark web, paste sites, Telegram channels and infostealer logs from 30+ malware families. Last checked 2026-11-05.
How to cite
Recorded Future, "2025 Identity Threat Landscape Report: Inside the Infostealer Economy," March 2026, https://www.recordedfuture.com/blog/identity-trend-report-march-blog. Compiled in Start with Identity, "Credential attack statistics 2026," https://startwithidentity.com/statistics/credential-attacks/#credential-attacks-recorded-future-auth-systems (checked 2026-11-05).
- 50%
Among ransomware victims with a prior credential or infostealer leak, 50% had that event within 95 days before the attack, according to Verizon's 2026 DBIR.
Source: Verizon, 2026 Data Breach Investigations Report, published May 19, 2026
Method: Verizon correlation of ransomware victims from the two previous years with infostealer and credential leak data, reported in the 2026 Data Breach Investigations Report. Last checked 2026-11-05.
How to cite
Verizon, "2026 Data Breach Investigations Report," May 19, 2026, https://www.verizon.com/business/resources/T343/reports/2026-dbir-data-breach-investigations-report.pdf. Compiled in Start with Identity, "Credential attack statistics 2026," https://startwithidentity.com/statistics/credential-attacks/#credential-attacks-dbir-infostealer-ransomware-window (checked 2026-11-05).
From SWI's own datasets
Computed from Start with Identity's own primary-sourced datasets each time the site is built, so these figures move when the data does. Follow each link for the records behind the number.
- 59%
of 123 identity-led breaches in our database (disclosed 2021 to 2026) began with a credential or session attack.
SWI Identity Breach Database - 23
incidents began with phishing (credential, adversary-in-the-middle or consent phishing).
SWI Identity Breach Database - 27
began with a login using credentials stolen earlier.
SWI Identity Breach Database - 10
began with credential stuffing or password spraying.
SWI Identity Breach Database - 8
began with help desk social engineering, MFA fatigue or a SIM swap.
SWI Identity Breach Database
What qualifies as a statistic
Every figure on this page is primary (linked to the publisher's own report, press release or official page, never a stats roundup), dated (the publisher's release date is shown) and has a stated method (survey sample, telemetry or official count). We read each number on its source page on the date shown as last checked, and drop anything we cannot verify.
Vendor surveys are labeled with the vendor's name: treat them as one company's view of its own customers or respondents, not a census. Spot an error or a newer edition? Tell us.
How to cite this page
Cite the original publisher for each number (every card has a "How to cite" line), and link this page as the compilation. Our compilation is CC BY 4.0; download it as CSV or JSON.
Start with Identity, "Credential attack statistics 2026," https://startwithidentity.com/statistics/credential-attacks/ (last checked 2026-11-05). Cite each figure to its original publisher.
Related on Start with Identity
More identity statistics
Credential attacks statistics: questions
- What percentage of breaches start with phishing in 2026?
- Verizon's 2026 Data Breach Investigations Report found phishing was the initial access vector in 16% of breaches, the same as the previous year. Mandiant's M-Trends 2026 saw email phishing fall to 6% of its investigations in 2025, while voice phishing rose to second place.
- How common are password attacks?
- Microsoft's Digital Defense Report 2025 says more than 97% of identity attacks are password attacks. Cloudflare found that about 41% of successful human logins on sites it protects involved leaked passwords, and bots made 95% of the login attempts that used leaked passwords.
- How many credentials do infostealers steal?
- Flashpoint recorded 1.7 billion credentials stolen by infostealer malware from 7.4 million infected hosts and devices between January and June 2026. SpyCloud recaptured 8.6 billion stolen cookies and session artifacts from malware infections in 2025.
- Can stolen session cookies bypass MFA?
- Yes. Recorded Future found 31% of the malware-sourced credentials it indexed in 2025, 276 million in all, included active session cookies that let attackers skip MFA. Microsoft reports 87.7% of phishing intrusions in its 2026 reporting period involved credential or session harvesting.
- Is voice phishing increasing?
- Yes. Microsoft reports weekly confirmed malicious vishing over cross-tenant Teams calls rose 502% year over year, and APWG member Crane Authentication saw voice phishing increase by 20% from Q1 to Q2 2026. Verizon found mobile-centric lures drew a 40% higher median click rate than email in simulations.