Over 100 advertised leaks and ransomware breaches targeted the automotive supply chain on the dark web in Q4 2025

Within dark web "database" activity, stealer logs comprised 67.12% of advertised/shared datasets, combolists 16.47%, and leaked credentials 5.96%.

In 2025, the Lumma infostealer was responsible for 2.2 million dark web listings, roughly 42% of the total.

SpyCloud identified 1.1 million password manager master passwords circulating in underground sources.

Across 449 dark web victim listings where details were available, the average data volume exfiltrated was 527.65GB in Q3 2025.

80 groups published victims on dark web leak sites in Q3 2025.

Analysis of over three million dark web posts shows stolen credentials far outpace credit card theft.

The majority (67%) of consumers believe that their personal information is already on the dark web.

There was a 43% increase in data breach data shared on underground forums in 2024.

More than half of darknet posts involved leaked databases

1.7 billion stolen credential records were shared in underground forums.

Initial access brokers on cybercriminal forums are increasingly offering: corporate credentials (20%), RDP access (19%), admin panels (13%), web shells (12%).

Over 100 billion compromised records were shared on underground forums in 2024. This represents a 42% year-over-year spike.

4 out of top 10 vulnerabilities most mentioned on the dark web are linked to sophisticated threat actors.

Analysis of dark web data reveals listings of infostealer advertisements increased 12% in 2024 over the previous year.

There was a 12% year-over-year increase of infostealer credentials for sale on the dark web.

Analysis of dark web data reveals a 25% increase in ransomware activity year-over-year.

Stolen access credentials published on dark web marketplaces increased by approximately 28% from approximately 6 million in 2023 to approximately 7.7 million in 2024.

SpyCloud's 2024 research reveals the staggering scale of exposed credentials circulating within the criminal underground: 3.1+ billion total passwords recaptured.

There were 2.2 billion credential pairs (username/email + password) recaptured.