Outpost24 Research Finds Infostealer Malware Affected 72% of Organizations With Exposed Credentials

The 2026 Credential Exposure Benchmark Report analyzed 31.5 million exposed credentials linked to 4,824 organizations in the US and Europe

STOCKHOLM, Sweden, November 3, 2026 - Outpost24, a global provider of cybersecurity solutions that helps thousands of organizations worldwide, today released its 2026 Credential Exposure Benchmark Report. Its researchers analyzed 31.5 million unique exposed credentials linked to 4,824 organizations across five industries in the United States and Europe, first detected between September 1, 2025, and September 1, 2026. The report finds that 72% of those organizations had staff or customer credentials identified in infostealer malware logs during that period.

Around 30.7 million of the credentials, roughly 97%, came from breach dumps and combolists, large collections of leaked logins that criminals compile and share. The remaining 844,000, under 3%, were stolen from infected devices by infostealer malware and are far more likely to reflect recent theft. Of the organizations analyzed, 41% had at least one infostealer-sourced credential on a staff email address, suggesting malware on a device used for work. A further 31% had malware-stolen credentials only on customer accounts.

“Less than 3% of exposed credentials came directly from infostealer logs, yet nearly three-quarters of organizations were affected. That tells us why counting stolen passwords isn't enough,” said Borja Rodriguez, Head of Threat Intelligence at Outpost24. “An infostealer doesn't stop at one password. It can take session cookies, saved credentials and access to multiple accounts. Resetting a password may close one door while leaving others wide open. Security teams need to investigate the infection, not just the exposed credential.”

The research found that exposure varies far more by industry than by location. Consumer Goods and Services had the most exposed credentials, 498 at the typical organization, almost all belonging to customers. Business Services ranked fourth on total credentials but first on staff exposure, with 47% of organizations holding a malware-stolen staff credential. Financial Services had the highest share of organizations with at least one infostealer-sourced credential, at 77%.

The typical European organization had 22% more exposed credentials than its US counterpart, 224 compared with 184. The share stolen by malware was similar in both.

Of the six European regions, the Nordics had the highest exposure, with 358 credentials at the typical organization, and the most credentials stolen by infostealers. The UK and Ireland had the highest share stolen by malware, at 2.7%. Spain had the lowest exposure, at 133 credentials at the typical organization. The highest combination of industry and region in Europe was Consumer Goods and Services in Benelux, at 1,285 credentials for the typical organization.

“The company with the most exposed credentials isn't necessarily the one with the greatest threat to its own systems,” Rodriguez added. “Thousands of stolen customer logins tell a very different story from a handful of compromised employee accounts. One points primarily to account takeover and fraud; the other could give attackers a foothold inside the business. Security teams need to know whose credentials were stolen, not just how many.”

The report recommends prioritizing credentials stolen by infostealers and investigating the wider compromise, rather than simply resetting the affected password. For staff credentials, security teams should investigate the associated user and device, including whether other passwords or session cookies were stolen, and revoke active sessions. For customer credentials, organizations should secure affected accounts through password resets, additional verification and fraud monitoring.

The report revisits the 2024 campaign against Snowflake customers, in which attackers used stolen credentials to log in to accounts without multi-factor authentication. It also points to Meta, which disclosed in October 2026 that attackers had reached some of its GitHub repositories using a single employee's stolen credentials.

The full report is available at http://outpost24.com/resources/2026-credential-exposure-benchmark-report/.

ABOUT OUTPOST24

Outpost24 is a leading global provider of cybersecurity solutions, encompassing two specialized divisions to deliver comprehensive exposure and access management. The company helps thousands of organizations worldwide proactively identify, manage, and reduce cyber risk across their entire digital and human attack surface. This is achieved through the combined expertise of Outpost24, the Attack Surface Management division focused on holistic Exposure Management, and Specops, the Identity and Access Management provider specializing in world-class Identity and Password Security and Zero Trust solutions. Founded in 2001 and headquartered in Sweden, Outpost24 operates globally with 14 offices worldwide, including in the US, UK, France, Belgium, Spain, and Israel. Learn more about Outpost24 at outpost24.com.