Cybersecurity Statistics

Cybersecurity statistics / Credential Theft

Listings of stolen credentials linked to LummaC2 increased by 72% on underground marketplaces.

Publisher	Ontinue
Report	2H 2025 Threat Intelligence Report
Published	30 March 2026
Topics	Credential Theft, Stolen Credentials, LummaC2, Underground Marketplace

Published by Ontinue in 2H 2025 Threat Intelligence Report, 30 March 2026. The figure is taken from the report as published; the full methodology is in the source.

View the original report

Related statistics

Credential harvesting is identified as the initial threat in 36% of ransomware incidents.

Proofpoint, 25/07/2026

Malicious links are identified as the initial threat in 47% of incidents, malicious attachments in 46%, credential harvesting in 36%, and Business Email Compromise in 35%.

Proofpoint, 25/07/2026

11% of the top 100 vendors most commonly used by universities currently show evidence of active infostealer malware infections.

UpGuard, 04/07/2026

43% of internal authentication traffic still relies on NTLM, a legacy protocol frequently abused for credential replay and privilege escalation attacks.

Zero Networks, 15/06/2026

72% of organizations do not detect credential misuse in real time, often taking hours or sometimes days or weeks to identify unauthorized privileged access.

Keeper Security, 27/05/2026

45% of MSPs who reported BYOD-related security incidents cite credential theft or account compromise as a cause

Omdia & Aura Business, 27/05/2026

Get the newsletter

Weekly cybersecurity statistics by email.