19% of Gen Z share passwords verbally.

Gen Z is the most likely generation to use password management software (46%). This compares to 39% of Millennials and 33% of Gen X.

Credentials or data were stolen in nearly half of all cyberattacks.

Stolen access credentials published on dark web marketplaces increased by approximately 28% from approximately 6 million in 2023 to approximately 7.7 million in 2024.

SpyCloud's 2024 research reveals the staggering scale of exposed credentials circulating within the criminal underground: 3.1+ billion total passwords recaptured.

The average exposure for a single employee identity in 2024, under a traditional exposure model, shows 11 records per employee, 1 unique username, 1 total username, 1 unique email, 11 total emails, 7 credential pairs, and 7 unique sources (breach, malware, or phish).

There was an average of 44 exposed credentials per malware infection.

By using holistic identity matching for an individual employee, the average exposure increases to 146 records per employee, 22 unique usernames, 13 total usernames, 89 unique emails, 141 total emails, 57 credential pairs, and 8 unique sources. This represents more than 12x the exposed data compared to the traditional view.

There were 2.2 billion credential pairs (username/email + password) recaptured.

An alarming 70% of users exposed in breaches last year reused previously-exposed passwords across multiple accounts, an increase from 61% in 2023.

There were 895,802 stolen credential records for enterprise AI tools observed by SpyCloud in 2024.

SpyCloud found 159,313 stolen credential records from popular password managers in 2024.

SpyCloud recaptured 7 million stolen credential records for third-party applications in 2024, a 48% increase from the year prior.

93% of the recaptured passwords were cracked by SpyCloud and delivered as plaintext.

Under holistic identity matching, the average exposure for a single consumer identity shows 229 records per customer, 52 unique usernames, 105 total usernames, 27 unique emails, 125 total emails, 227 credential pairs, and 9 unique sources.

142.27 million individuals had a password exposed in 2024, a 125% increase from 2023.

51% of respondents said fraud is more common when using username and password alone.

90% of IT admins rely on employees to update their own credentials.

46% of IT leaders suggest that simplified workflows for non-technical users would facilitate easier and timelier password updates.

45% of IT leaders advocate for regular security training to instil robust password habits and awareness among employees