Cybersecurity Statistics

Cybersecurity statistics / Credential Theft

23.34% of the global ecosystem have corporate credentials circulating on the dark web via stealer logs.

Publisher	Black Kite
Report	2026 Third-Party Breach Report: Managing Risk Concentration in the Era of Cascading Failures
Published	7 March 2026
Topics	Credential Theft, Corporate Credentials, Dar Web, Stealer Logs

Published by Black Kite in 2026 Third-Party Breach Report: Managing Risk Concentration in the Era of Cascading Failures, 7 March 2026. The figure is taken from the report as published; the full methodology is in the source.

View the original report

Related statistics

Credential harvesting is identified as the initial threat in 36% of ransomware incidents.

Proofpoint, 25/07/2026

Malicious links are identified as the initial threat in 47% of incidents, malicious attachments in 46%, credential harvesting in 36%, and Business Email Compromise in 35%.

Proofpoint, 25/07/2026

11% of the top 100 vendors most commonly used by universities currently show evidence of active infostealer malware infections.

UpGuard, 04/07/2026

43% of internal authentication traffic still relies on NTLM, a legacy protocol frequently abused for credential replay and privilege escalation attacks.

Zero Networks, 15/06/2026

72% of organizations do not detect credential misuse in real time, often taking hours or sometimes days or weeks to identify unauthorized privileged access.

Keeper Security, 27/05/2026

45% of MSPs who reported BYOD-related security incidents cite credential theft or account compromise as a cause

Omdia & Aura Business, 27/05/2026

Get the newsletter

Weekly cybersecurity statistics by email.