Compromised credentials accounted for 74% of ransomware intrusions observed by Beazley Security investigators in Q1 2026.

Identity, cloud, and credential compromise accounted for 85% of actionable security alerts.

3.3 billion compromised credentials and cloud tokens make identity the primary exploit vector.

Both infostealer infections and compromised credentials are on track to surpass 2024 figures, which saw over 4.3 million machines infected with approximately 330 million compromised credentials. This indicates a 24% increase YoY in these areas.

2.67 million machines were infected by infostealer malware in H1 2025. This led to more than 204 million compromised credentials being observed.

Of organisations that experienced attacks, 38% of breaches stemmed from compromised employee credentials.