PHILADELPHIA, PA — Infostealer malware compromised employee or customer credentials linked to 72% of nearly 5,000 organizations examined in a cybersecurity study released this week, highlighting how relatively small volumes of malware-stolen passwords can create widespread risks of account takeover and unauthorized system access.
Cybersecurity firm Outpost24 analyzed 31.5 million unique exposed credentials associated with 4,824 organizations across five industries in the United States and Europe for its 2026 Credential Exposure Benchmark Report.
The credentials were first detected between Sept. 1, 2025, and Sept. 1, 2026.
Approximately 30.7 million credentials, or 97% of the total, originated from breach dumps and combolists, collections of previously exposed usernames and passwords circulated among cybercriminals.
The remaining 844,000 credentials, representing less than 3%, came from infostealer malware that extracts information directly from infected devices.
Despite accounting for a small share of the exposed credentials, infostealer activity affected nearly three-quarters of the organizations studied.
The research found that 41% of organizations had at least one malware-stolen credential associated with an employee email address, indicating possible compromise of a device used for work.
Another 31% had infostealer-sourced credentials associated exclusively with customer accounts.
The distinction matters because compromised employee credentials can provide attackers with access to internal systems, while stolen customer credentials primarily expose organizations to account takeovers and fraud.
“Less than 3% of exposed credentials came directly from infostealer logs, yet nearly three-quarters of organizations were affected,” Borja Rodriguez, Outpost24’s head of threat intelligence, explained. “That tells us why counting stolen passwords isn’t enough.”
Infostealer malware can collect more than usernames and passwords, including browser session cookies and stored authentication information that may allow attackers to maintain access even after a password change.
“Resetting a password may close one door while leaving others wide open. Security teams need to investigate the infection, not just the exposed credential,” Rodriguez warned.
The study identified substantial differences in credential exposure across industries.
Consumer Goods and Services recorded the highest number of exposed credentials, with a typical organization having 498 compromised credentials, nearly all associated with customers.
Business Services ranked fourth in overall credential exposure but had the highest proportion of organizations with malware-stolen employee credentials, at 47%.
Financial Services recorded the highest share of organizations affected by infostealer-sourced credentials overall, at 77%.
The findings indicate that the number of exposed credentials alone may not accurately represent an organization’s risk of internal compromise.
A business with thousands of exposed customer logins faces different security consequences from one with a smaller number of compromised employee accounts capable of accessing corporate systems.
Geographic differences were less pronounced than industry differences.
The typical European organization had 224 exposed credentials, compared with 184 for its U.S. counterpart, a 22% difference. The proportion originating from infostealer malware was similar in both markets.
Within Europe, the Nordic region recorded the highest typical exposure, at 358 credentials per organization, and the largest number of infostealer-stolen credentials.
The United Kingdom and Ireland had the highest proportion of credentials obtained through infostealers, at 2.7%, while Spain recorded the lowest typical exposure, at 133 credentials per organization.
Consumer Goods and Services organizations in the Benelux region had the highest exposure among the European industry-region combinations examined, with 1,285 credentials at the typical organization.
Outpost24 recommended that businesses distinguish between older credentials circulating in breach databases and credentials recently stolen from infected devices.
For employee accounts, the report advises investigating the associated user and device, determining whether additional passwords or session cookies were compromised, and revoking active sessions.
For customer accounts, recommended measures include password resets, additional identity verification and fraud monitoring.
The report cited the 2024 attacks against customers of cloud data platform Snowflake, in which attackers used stolen credentials to access accounts lacking multifactor authentication.
It also referenced an October 2026 disclosure by Meta involving unauthorized access to some of its GitHub repositories through a single employee’s stolen credentials.
Both incidents illustrate how compromised authentication information can expose corporate resources without requiring attackers to exploit a software vulnerability.
“The company with the most exposed credentials isn’t necessarily the one with the greatest threat to its own systems,” Rodriguez noted. “Security teams need to know whose credentials were stolen, not just how many.”
The findings underscore the importance of examining the source and ownership of compromised credentials rather than relying solely on the total number detected.
The full 2026 Credential Exposure Benchmark Report is available at http://outpost24.com/resources/2026-credential-exposure-benchmark-report/.
Support the local news that supports Chester County. MyChesCo delivers reliable, fact-based reporting and essential community resources—free for everyone. If you value that, click here to become a patron today.