Credential Attack Statistics 2026
By Axis Intelligence Research
Co-author: Marcus Chen, Cybersecurity | Last updated: September 3, 2026 | License: CC BY 4.0
Stolen credentials appear somewhere in 39% of confirmed data breaches, more than any other technique, even though credential abuse fell to 13% as the first step in. Reported United States phishing losses per complaint rose eighteen-fold in two years while complaint volume fell 36%. Credential attacks did not slow down. They got quieter and more expensive.
Quick Answer
Credential abuse is present in 39% of confirmed breaches worldwide, per the Verizon 2026 DBIR, but registers as only 13% of first-known initial access vectors after a methodology change. Password attacks account for more than 97% of identity attacks tracked by Microsoft. According to Axis Intelligence Research, the Axis Credential Severity Index (ACSI™) reached 678.8 for 2025 against a 2023 baseline of 100, meaning the average reported credential-theft complaint in the United States now carries roughly seven times the financial damage it did two years earlier.
Key Findings
- According to Axis Intelligence Research, credential abuse appears three times more often across the full breach chain (39%) than it does as the first known entry point (13%) in the Verizon 2026 Data Breach Investigations Report.
- According to Axis Intelligence Research, reported loss per phishing and spoofing complaint in the United States rose from $62.66 in 2023 to $1,126.76 in 2025, an eighteen-fold increase, while complaint volume fell 35.9% over the same period (FBI IC3 2025 Annual Report).
- According to Axis Intelligence Research, the Axis Credential Severity Index (ACSI™) reads 678.8 for 2025, up from 291.2 in 2024 against a 2023 baseline of 100.
- According to Axis Intelligence Research, complainants aged 60 and over filed 31.6% of age-identified phishing complaints but absorbed 42.3% of the associated losses, a loss-per-complaint gradient of 4.0x against the 20-to-29 band.
- According to Axis Intelligence Research, 73% of ransomware victims in the Verizon 2026 DBIR had an infostealer or credential-leak event in the year before they were named publicly, and half of those events occurred within 95 days of victim publication.
How Many Breaches Involve Stolen Credentials in 2026?
The headline from the Verizon 2026 Data Breach Investigations Report is that exploitation of vulnerabilities became the most common initial access vector for the first time in the report’s nineteen-year history, reaching 31% of breaches against credential abuse at 13%. That comparison is accurate. It is also the single most misread number in credential security this year.
Two things happened at once. Verizon added Pretexting to its tracked list of initial access vectors, and pretexting frequently overlaps with credential abuse. The report states plainly that without that addition, credential abuse would have registered at 16% rather than 13%. So roughly a third of the apparent decline is a change in how the DBIR counts, not a change in what attackers do.
The second thing is more important. Initial access is one step. When Verizon counts credential abuse anywhere in the breach progression, the figure is 39%, which is still higher than any other technique in the corpus.
Credential abuse across the breach chain
| Measure | Value | Sample | Source |
|---|---|---|---|
| Credential abuse, first known initial access vector | 13% | n=19,905 | Verizon 2026 DBIR |
| Same measure, excluding the Pretexting methodology change | 16% | n=19,905 | Verizon 2026 DBIR |
| Credential abuse, anywhere in the breach progression | 39% | n=19,905 | Verizon 2026 DBIR |
| Use of stolen credentials, action variety | 36% | n=19,550 | Verizon 2026 DBIR |
| Credentials as a compromised data type | 28% | n=19,538 | Verizon 2026 DBIR |
| Vulnerability exploitation, initial access | 31% | n=20,023 | Verizon 2026 DBIR |
The 2026 DBIR analyzed more than 31,000 security incidents and more than 22,000 confirmed breaches across 145 countries, covering November 1, 2024 through October 31, 2025. External actors drove 88% of breaches and the human element was present in 62%.
Inside the System Intrusion pattern, which accounts for 60% of all breaches, stolen credentials and vulnerability exploitation are dead even at 39% each. Credentials themselves were stolen in 26% of those breaches, which is the part that matters operationally: a credential-driven intrusion tends to produce more credentials on the way out.
Marcus Chen, Cybersecurity: The vulnerability headline is real and defenders should act on it. But the framing that identity risk is receding does not survive contact with the same report’s own data. An initial access vector is the first thing you can prove. Credential abuse is what happens for the next forty days. If your control investment tracks the 13% number instead of the 39% number, you have optimized for the front door of a building where most of the movement is on the stairwells. Compare it to the 2025 edition and the direction that matters is not credential abuse falling, it is third-party involvement climbing from 30% to 48% in a single year, because that is where credentials leave your visibility entirely.
The third-party credential problem
Third-party involvement reached 48% of breaches, a 60% increase year over year. The DBIR’s remediation data from inside third-party cloud environments is where this stops being abstract. Only 23% of organizations fully remediated missing or improperly configured multi-factor authentication on their cloud accounts. For weak passwords and excessive permissions, only 31% reached full remediation, and clearing half the findings took almost eight months. In a point-in-time snapshot, 37% of organizations had an admin account with MFA disabled on an infrastructure-as-a-service platform, against 14% on Snowflake, where a well-publicized 2024 campaign appears to have changed behavior.
What Do Credential Attacks Cost, and Why Is Severity Rising Faster Than Volume?
This is where the published record gets thin, and where Axis Intelligence Research built its own measurement.
The FBI Internet Crime Complaint Center’s 2025 Annual Report logged 1,008,597 complaints and $20.877 billion in reported losses. Phishing and spoofing remained the single largest complaint category at 191,561 filings. Most coverage stops at the complaint count. The complaint count is the least interesting number in the table.
The Axis Credential Severity Index (ACSI™)
What it measures: how much financial damage the average reported credential-theft complaint carries, over time, holding the reporting channel constant.
Components (equal weight, one third each): loss per complaint for the three IC3 crime types where credential compromise is definitionally central — Phishing/Spoofing, Personal Data Breach, and Identity Theft. IC3 defines Phishing/Spoofing as unsolicited contact requesting personal, financial, or login credentials, which is why it anchors the index.
Formula: for each component, index = (loss per complaint in year Y ÷ loss per complaint in 2023) × 100. ACSI = the unweighted mean of the three component indices. Baseline: 2023 = 100.
Worked example, 2025 phishing component: $215,843,126 ÷ 191,561 complaints = $1,126.76 per complaint. Divided by the 2023 value of $62.66 ($18,728,550 ÷ 298,878), times 100 = 1,798.1.
| Component | 2023 loss/complaint | 2025 loss/complaint | 2025 index (2023=100) |
|---|---|---|---|
| Phishing and spoofing | $62.66 | $1,126.76 | 1,798.1 |
| Personal data breach | $13,325.09 | $19,493.06 | 146.3 |
| Identity theft | $6,381.02 | $5,866.86 | 91.9 |
| ACSI™ (mean) | 100.0 | — | 678.8 |
Source: Axis Intelligence Research calculation from FBI IC3 2023, 2024 and 2025 Annual Report crime-type tables. 2024 reading: 291.2.
One component dominates, and that is the finding rather than a defect. Identity theft severity is flat to slightly down. Personal data breach severity rose about half again. Phishing severity rose eighteen-fold. Reported phishing losses climbed 1,052.5% between 2023 and 2025 while complaints fell 35.9%. Fewer people are reporting, and the ones who do are reporting much larger amounts.
According to Axis Intelligence Research, this is the defining credential statistic of the 2026 cycle: volume metrics and severity metrics have decoupled, and any organization tracking credential risk by attempt count is measuring the wrong axis.
What the index does not capture
ACSI™ measures reported loss in a voluntary United States complaint channel. It does not capture unreported incidents, does not adjust for inflation, and cannot distinguish a genuine rise in per-victim harm from a shift in who bothers to file. Reporting-channel composition can move the index without the underlying threat moving at all. The three components are published separately above precisely so a reader can discount any one of them.
For context outside the complaint channel, IBM’s 2026 Cost of a Data Breach Report put the global average breach cost at a record $4.99 million across 602 organizations breached between March 2025 and February 2026. One in four malicious breaches was AI-enabled, averaging about $6 million. Ransomware reached 39% of breached organizations, and only 37% encrypted sensitive data both at rest and in transit.
A calculation we refused to publish
An obvious move here is to multiply the DBIR’s 39% credential-abuse prevalence by IBM’s $4.99 million average and present a global credential-attributable breach cost. Axis Intelligence Research does not publish that figure and has recorded the refusal in the dataset as a retracted row.
The two inputs are not compatible. The DBIR prevalence rate comes from an incident corpus of more than 22,000 breaches contributed by law enforcement and response firms, covering November 2024 to October 2025. The IBM mean comes from structured interviews at 602 organizations that agreed to participate, covering March 2025 to February 2026, Different populations, different sampling frames, different windows. Their product would be a number with a dollar sign and no meaning, and it is exactly the kind of figure that gets recited for three years before anyone checks it.
How Many Stolen Credentials Are Circulating Right Now?
Prevalence tells you how often credentials are used. Supply tells you why the technique never becomes uneconomic.
On November 5, 2025, Have I Been Pwned finished loading the largest corpus in its history, aggregated by threat-intelligence platform Synthient from locations where criminals had published it. Troy Hunt’s technical write-up documents the load: 1,957,476,021 unique email addresses and 1.3 billion unique passwords, of which 625 million had never appeared in Pwned Passwords before. A separate Synthient stealer-log corpus added 183 million unique addresses.
| Measure | Value | Source |
|---|---|---|
| Unique email addresses in the credential stuffing corpus | 1,957,476,021 | Have I Been Pwned |
| Unique passwords | 1,300,000,000 | Have I Been Pwned |
| Passwords never previously seen in Pwned Passwords | 625,000,000 | Have I Been Pwned |
| Distinct email domains represented | 32,000,000 | Have I Been Pwned |
| Pre-existing HIBP credential corpus | 15,000,000,000 | Have I Been Pwned |
| HIBP subscribers appearing in this corpus | 2,900,000 of 5,900,000 | Have I Been Pwned |
Two derived figures matter. According to Axis Intelligence Research, 48.1% of the passwords in that corpus (625 million of 1.3 billion) were new to the world’s largest breached-password service, which rules out the comfortable assumption that these lists are simply old data recirculating. And 49.2% of Have I Been Pwned’s subscriber base appeared in this single corpus — a population that is, by definition, more security-aware than average.
Hunt also killed a false headline worth repeating: this was not a Gmail breach. Gmail accounts for 394 million addresses, roughly 20.1% of the corpus, because Gmail is the largest provider. The remaining 79.9% has nothing to do with Google.
Supply feeds directly into extortion. The DBIR found that 27% of ransomware victims had no associated infostealer or credential-leak event in the prior year, which means, per Axis Intelligence Research, that 73% did. Among those, half saw the credential event within 95 days of being publicized as a ransomware victim.
Marcus Chen, Cybersecurity: Ninety-five days is a detection window, not a statistic. It is roughly one quarter between the moment a credential appears in a stealer log and the moment a name shows up on a leak site. Nobody needs a new product to act on that. It means dark-web credential monitoring keyed to your own domains has a measurable, bounded lead time, and that the boring work of forcing a reset on every hit is defensible on the numbers. Also worth saying: the 240% year-over-year growth Verizon reports in attackers using legitimate remote monitoring and management software is the same story in different clothing. Valid credentials plus approved tooling produces an intrusion that looks like an administrator until the encryption starts.
Who Is Actually Being Targeted by Credential Phishing?
Almost nobody publishes credential-phishing loss by age band. The IC3 data supports it, so Axis Intelligence Research built it.
The Axis Credential Loss Gradient (ACLG™)
Formula: for each reported age band, ACLG = IC3 2025 Phishing/Spoofing losses for that band ÷ complaints for that band. Worked example, 60 and over: $77,020,936 ÷ 48,064 = $1,602.47.
| Age band | Complaints | Reported losses | Loss per complaint | Share of complaints | Share of losses |
|---|---|---|---|---|---|
| Under 20 | 2,380 | $360,429 | $151.44 | 1.6% | 0.2% |
| 20 to 29 | 19,765 | $7,954,797 | $402.47 | 13.0% | 4.4% |
| 30 to 39 | 27,433 | $32,669,619 | $1,190.89 | 18.0% | 18.0% |
| 40 to 49 | 27,800 | $33,063,856 | $1,189.35 | 18.3% | 18.2% |
| 50 to 59 | 26,782 | $30,918,367 | $1,154.45 | 17.6% | 17.0% |
| 60 and over | 48,064 | $77,020,936 | $1,602.47 | 31.6% | 42.3% |
Source: Axis Intelligence Research calculation from FBI IC3 2025 Annual Report age-band tables. Shares are of age-identified complaints only, which represent 79.5% of the 191,561 total.
The shape is not a smooth curve. It is a step. Loss per complaint roughly triples between the 20-to-29 band and the 30-to-39 band, then sits almost flat across three decades of working life between $1,154.45 and $1,190.89, then rises again to $1,602.47 at 60 and over. According to Axis Intelligence Research, the gradient from the 20-to-29 band to the 60-and-over band is 4.0x.
The flat middle is the part security awareness programs should sit with. Between 30 and 59, three age bands with very different technology habits produce almost identical per-complaint losses. That points to the value of the account being drained rather than the sophistication of the target, which is an argument for control design over user education.
Supporting IC3 categories tell the same story with different labels: personal data breach filings reached 67,456 complaints and $1.31 billion, identity theft 31,675 and $185.8 million, business email compromise 24,768 and $3.05 billion, account takeover roughly 4,700 complaints and $359.7 million, and SIM swap 971 complaints and $17.4 million.
How Do Attackers Get Past Multi-Factor Authentication?
They mostly do not. They go around the enrollment process, or they never reach an MFA prompt at all.
Microsoft’s Digital Defense Report 2025, covering July 2024 through June 2025, reports that more than 97% of identity attacks are password attacks — bulk guessing and spraying against credentials sourced largely from leaks. Identity-based attacks rose 32% in the first half of 2025. Microsoft analyzes 38 million identity risk detections and screens 5 billion emails daily. The countermeasure is unambiguous in the same data: phishing-resistant MFA stops over 99% of these attacks even when the attacker holds a valid username and password.
That leaves the residual, which is where the year’s most disruptive intrusions lived. The CISA and FBI joint advisory on Scattered Spider, last revised July 29, 2025, documents the pattern: impersonating employees to IT help desks to obtain credentials, convincing staff to share one-time passcodes, push bombing, and SIM swaps to capture MFA prompts. The DBIR’s own social-engineering data lines up — pretexting reached 6% of initial access, and in phishing simulations the median click rate on mobile-centric vectors such as voice and text ran 40% higher than email.
On the AI question, the DBIR is measured rather than alarmed. Working from a dataset of 793 threat actors on an AI platform, phishing accounted for 44% of AI-assisted initial access techniques and vulnerability exploitation 32%, with a median of 15 distinct techniques per actor. Verizon notes that phishing’s share of its own incident dataset has barely moved, which argues that AI assistance is currently raising the floor on attacker competence rather than the ceiling on success rates.
Which Controls Actually Close the Credential Gap?
The prescriptive answer is now a federal standard rather than an opinion. NIST SP 800-63B-4 sets requirements that most enterprise password policies still do not meet:
- Passwords used as a single factor SHALL be a minimum of 15 characters; passwords used only as part of MFA SHALL be a minimum of 8.
- Verifiers SHALL compare every proposed password in full against a blocklist of commonly used, expected, or compromised values, including passwords from previous breach corpuses.
- Verifiers SHALL NOT impose composition rules and SHALL NOT require periodic rotation, but SHALL force a change on evidence of compromise.
- Verifiers SHALL rate-limit consecutive failed attempts, with 100 as the upper bound before the authenticator is disabled.
- At AAL2, verifiers SHALL offer at least one phishing-resistant option; at AAL3 it is required, and OTP and out-of-band authenticators are explicitly not phishing-resistant because manual entry does not bind the output to the session.
Read that list against the numbers above and the gap is specific. Blocklist screening is the direct countermeasure to a 1.3-billion-password corpus of which 625 million entries were previously unknown. The 15-character minimum is the countermeasure to spraying that constitutes 97% of identity attacks. Phishing-resistant enrollment is the countermeasure to the help-desk reset path in the Scattered Spider advisory. None of these are new ideas. What is new is that the third-party remediation data shows how rarely they get finished: 23% full remediation on cloud MFA gaps, 31% on weak passwords and excessive permissions.
For adjacent Axis datasets, see our cybersecurity statistics pillar for breach costs and ransomware trends, password statistics for user-side behavior and passkey adoption, the 19 billion compromised passwords analysis for corpus-level reuse rates, the live data breach tracker for incident-by-incident attack vectors, the KEV tracker for the vulnerability side of initial access, and AI cyberattack statistics for attacker tooling trends.
Methodology
Collection. Every figure in this article was retrieved on September 3, 2026 from a primary document opened during production: the Verizon 2026 DBIR PDF, the FBI IC3 2025 Annual Report PDF, the IBM Cost of a Data Breach 2026 newsroom release, the Microsoft Digital Defense Report 2025 publication summary, the Have I Been Pwned corpus write-up by Troy Hunt, NIST SP 800-63B-4, and CISA advisory AA23-320A. No figure in this article is sourced from secondary aggregation or from prior recall. Each has a row in the accompanying CSV with its source organization, document, URL, and retrieval date.
Axis calculations. All derived figures are marked axis_calculated = yes in the dataset and carry a method_note containing the arithmetic. The two named metrics, ACSI™ and ACLG™, carry data_type = original_metric. Both were computed in Python from the published source values and both are reproducible by any reader from the IC3 crime-type and age-band tables.
Index construction. ACSI™ uses equal weights across three components because there is no defensible basis for weighting one IC3 crime type above another — the categories are self-selected by complainants, not assigned by severity. Baseline year 2023 was chosen as the earliest year present in the IC3 three-year comparison tables published in the 2025 report, which keeps every component on a single sourcing basis. If components or weights change in a future edition, the index will be re-baselined openly and prior readings will not be silently rewritten.
Refusals. One calculation was attempted and rejected: a credential-attributable global breach cost derived from DBIR prevalence and IBM cost data. It is recorded in the dataset with data_type = retracted and the reasoning in its method note.
Reporting boundaries. IC3 figures are United States complaints filed voluntarily and reflect reported loss, not total economic loss; IC3 states that ransomware losses in particular exclude lost business, wages, and remediation. DBIR figures come from a contributed incident corpus whose composition shifts as contributors join and leave. Microsoft figures reflect Microsoft telemetry. IBM figures reflect 602 self-selected organizations. These datasets are not interchangeable and are not merged anywhere in this article.
About This Dataset
File: credential-attack-statistics-2026.csv — 144 rows, 14 columns, UTF-8, comma-separated.
Columns: metric, value, unit, as_of_date, geography, segment, source_org, source_document, source_url, retrieved_date, is_primary, axis_calculated, method_note, data_type.
Coverage: global and United States credential attack prevalence, cost, corpus volume, and control-remediation figures for calendar years 2023 through 2026 reporting periods.
License: Creative Commons Attribution 4.0 International (CC BY 4.0). Free to reuse, republish, and redistribute with attribution.
How to Cite This Research
APA: Axis Intelligence Research. (2026). Credential attack statistics 2026: Volume, cost, and the severity shift. https://axis-intelligence.com/credential-attack-statistics/
MLA: Axis Intelligence Research. “Credential Attack Statistics 2026: Volume, Cost, and the Severity Shift.” Axis Intelligence, 3 Sept. 2026, axis-intelligence.com/credential-attack-statistics/.
Chicago: Axis Intelligence Research. “Credential Attack Statistics 2026: Volume, Cost, and the Severity Shift.” Axis Intelligence, September 3, 2026. https://axis-intelligence.com/credential-attack-statistics/.
Frequently Asked Questions
What percentage of data breaches involve stolen credentials in 2026?
Credential abuse appears somewhere in the breach chain in 39% of confirmed breaches in the Verizon 2026 DBIR, higher than any other technique. As the first known initial access vector it registers at 13%, down from 22% the year before, though Verizon notes the figure would have been 16% without the addition of Pretexting as a separately tracked vector.
Did vulnerability exploitation really overtake credential theft?
As a first initial access vector, yes: 31% versus 13%, the first time in the DBIR’s nineteen-year history. Across the full breach progression, no. Credential abuse remains the most pervasive technique in the dataset at 39%, and stolen credentials appear as an action variety in 36% of breaches.
What is the Axis Credential Severity Index?
ACSI™ is an Axis Intelligence Research metric measuring reported financial damage per credential-theft complaint in the United States, indexed to 2023 = 100. It is the equal-weight mean of three component indices built from FBI IC3 loss-per-complaint figures for phishing and spoofing, personal data breach, and identity theft. The 2025 reading is 678.8, up from 291.2 in 2024.
Why did phishing complaints fall while phishing losses rose?
IC3 phishing and spoofing complaints fell 35.9% between 2023 and 2025 while reported losses rose 1,052.5%. Reported loss per complaint went from $62.66 to $1,126.76. The IC3 data does not explain the divergence, and Axis Intelligence Research does not speculate on cause. What the figures establish is that complaint volume is no longer a usable proxy for credential-attack harm.
How many stolen credentials are circulating in 2026?
The largest single corpus indexed by a primary source contains 1,957,476,021 unique email addresses and 1.3 billion unique passwords, loaded into Have I Been Pwned on November 5, 2025. Of those passwords, 625 million — 48.1% — had never been seen by Pwned Passwords before. HIBP’s pre-existing corpus stood at roughly 15 billion records.
Does multi-factor authentication still stop credential attacks?
Microsoft reports that phishing-resistant MFA blocks over 99% of identity-based attacks even when the attacker holds valid credentials, and that more than 97% of identity attacks are password attacks that such MFA defeats outright. The residual risk sits in enrollment and recovery: the CISA and FBI Scattered Spider advisory documents help-desk impersonation, one-time-passcode solicitation, push bombing, and SIM swapping as the working bypass routes.
How long is the gap between a credential leak and a ransomware attack?
Among Verizon 2026 DBIR ransomware victims that had a prior infostealer or credential-leak event, half saw that event within 95 days of being publicized as a victim. Twenty-seven percent of ransomware victims had no associated credential event in the prior year, which means 73% did.
What does NIST require for password policy now?
NIST SP 800-63B-4 requires a 15-character minimum for passwords used as a single factor and 8 characters within MFA, mandatory blocklist screening of the full proposed password against known compromised values, no composition rules, and no periodic rotation except on evidence of compromise. Rate limiting is capped at 100 consecutive failed attempts before the authenticator is disabled.
Which age group loses the most to credential phishing?
Complainants aged 60 and over. In IC3 2025 data they filed 31.6% of age-identified phishing complaints and absorbed 42.3% of associated losses, at $1,602.47 per complaint. The 20-to-29 band reported $402.47 per complaint, a 4.0x gradient. Loss per complaint is nearly flat between $1,154.45 and $1,190.89 across the 30-to-59 bands.
Can I reuse this data?
Yes. The dataset is published under CC BY 4.0. Cite as: Axis Intelligence Research, Credential Attack Statistics 2026, axis-intelligence.com.