Each compromised device yielded an average of 87 stolen credentials.

Publisher	Recorded Future
Report	2025 Identity Threat Landscape Report
Published	16 March 2026
Topics	Identity, Credentials, Compromised Device

Published by Recorded Future in 2025 Identity Threat Landscape Report , 16 March 2026. The figure is taken from the report as published; the full methodology is in the source.

View the original report

Related statistics

Compromised credentials accounted for 23% of ransomware incidents.

Sophos, 18/07/2026

67% of ransomware victims confirmed their ransomware incident was the same event as their most significant identity attack.

Sophos, 18/07/2026

67% of root causes across 661 incident response and managed detection and response (MDR) cases are identity-related.

Sophos, 18/07/2026

79% of ransomware attacks start with an identity-based approach.

Sophos, 18/07/2026

Multi-factor authentication (MFA) is missing where it matters in 59% of IR and MDR cases.

Sophos, 18/07/2026

97% of victims where compromised credentials are identified as the root cause have MFA enabled in some form at the time of the attack.

Sophos, 18/07/2026

Get the newsletter

Weekly cybersecurity statistics by email.