Verizon's 2026 Data Breach Investigations Report (DBIR) found that credential abuse appeared at some point in 39% of the breaches it studied, more than any other technique, across more than 22,000 confirmed breaches in 145 countries. Have I Been Pwned, which tracks leaked account data, lists 17,847,746,941 breached account records as of 3 November 2026. This page pulls both together, with the regulator and standards guidance on what to do about them.
What share of breaches involve stolen credentials?
Verizon's 2026 DBIR says that if you count every instance of credential abuse at any point in a breach, it still sits on top at 39%. The report analyzed more than 31,000 incidents, of which more than 22,000 were confirmed data breaches. Separately, credentials were among the data stolen in 28% of breaches.
The 39% figure is wider than the better-known initial access number. It counts a stolen password used to get in, to move sideways, or to reach a second system. Verizon also notes that how attackers obtain credentials is often unknown. They may come from phishing, from infostealer malware, or from data exposed in earlier breaches and later packaged and sold on the dark web.
In the System Intrusion pattern, which accounts for 60% of breaches in the report, stolen credentials and exploited vulnerabilities each served as the initial access vector in 39% of breaches. Ransomware appeared in 77% of those breaches. In Basic Web Application Attacks, credentials were the data compromised in 52% of breaches.
Stolen credentials are the most common thread through a breach, even when they are not the front door.
Why did credential abuse fall to 13% as an initial access vector?
Credential abuse as the first step fell from 22% in the 2025 DBIR to 13% in 2026, according to Verizon. Part of that is a counting change. Verizon added pretexting as a tracked initial access vector this year, and without that addition the credential abuse figure would have been 16%.
Figure 2: Share of breaches by initial access vector. Source: Verizon, 2026 Data Breach Investigations Report, Key topics and Results and analysis sections.
Exploitation of vulnerabilities is now the most common initial access vector at 31%, up from 20% a year earlier. Phishing held steady at 16%, and pretexting, where an attacker talks a victim into handing something over, reached 6%. Our phishing statistics for 2026 cover how many of those messages are reported and what they cost.
Verizon's own advice on the 13% figure is direct. It says defenders should not discount credential abuse, because it is pervasive across attack paths, and it tells readers to stop postponing their MFA rollout. The report's CIS Controls guidance for stolen credentials lists requiring MFA for externally exposed applications and for remote network access.
A falling headline share does not mean credentials matter less. It means other doors opened wider.
How do stolen credentials lead to ransomware?
Verizon's 2026 DBIR found that 27% of ransomware victims had no associated infostealer or credential leak in the year before the attack. Among the victims that did, 50% had a credential or infostealer event within 95 days before the attack. The timing distribution in Verizon's figure is based on n=4,395 credential leakage events.
Figure 3: How a leaked credential can become a ransomware incident, an illustrative sequence drawing on the initial access broker and stolen credential discussion in Verizon's 2026 DBIR.
The sale of access matters here. Verizon reports that 44% of the access offers it tracked from initial access brokers were VPN connections, followed closely by remote desktop tools such as RDP and VNC (n=876 offers). Ransomware groups often buy a login instead of earning one.
Size does not protect an organization. Verizon found that small organizations in its dataset experienced a median of seven credential leak events during the year, while larger organizations faced around 20. Not every leak leads to ransomware, but each one is a usable entryway. The same pattern shows up in our small business data breach statistics.
A leaked login can sit unused for weeks, and half of the cases that end in ransomware strike within about three months.
How many stolen credentials are in circulation?
As of 3 November 2026, Have I Been Pwned (HIBP) reports 1,049 breached websites and 17,847,746,941 breached account records on its home page. A count of HIBP's public breach list shows that 674 of those breaches, or about 64%, included passwords. Those 674 breaches hold 11,795,478,211 account records.
Figure 4: The five largest password-bearing collections in HIBP, in millions of account records. Source: Have I Been Pwned breach list, retrieved 3 November 2026.
These are account records, not unique people. One person with five reused logins can appear in many entries. HIBP is also a live dashboard that grows weekly, so the totals above are a snapshot rather than a fixed historical number.
The largest entry is recent. Synthient aggregated credential-stuffing lists during 2025, covering 1,957,476,021 email addresses, and HIBP says the data also included 1.3 billion unique passwords. Stealer logs are a growing category too. HIBP's ALIEN TXTBASE entry, from February 2025, contained 284,132,969 unique email addresses, and a June 2026 stealer log collection added 56,278,397 more, along with 124 million unique passwords.
Figure 5: Breaches added to HIBP each calendar year; 2026 runs to 3 November. Source: Have I Been Pwned breach list, retrieved 3 November 2026.
| Measure | Value | Source and date |
|---|---|---|
| Credential abuse at any stage of a breach | 39% | Verizon DBIR, 2026 |
| Credential abuse as initial access vector | 13% (22% in 2025) | Verizon DBIR, 2026 |
| Breaches in HIBP | 1,049 | HIBP, 3 November 2026 |
| Breached account records in HIBP | 17,847,746,941 | HIBP, 3 November 2026 |
| HIBP breaches that include passwords | 674 | HIBP breach list, counted 3 November 2026 |
| Breaches added to HIBP in 2026 so far | 114 | HIBP breach list, counted 3 November 2026 |
Source: Verizon 2026 DBIR; Have I Been Pwned. HIBP counts are derived from its public breach list.
Billions of records are already circulating, and the 2026 list is on pace to be the busiest year in the table. Our data breach statistics put those leaks in the context of overall breach counts.
What do regulators and standards say to do about stolen credentials?
NIST's SP 800-63B-4 sets three password rules that cut against old habits. Verifiers must check new passwords against a blocklist of commonly used or compromised passwords, must not impose composition rules such as mixing character types, and must not require periodic password changes unless a credential may be compromised. Single-factor passwords must be at least 15 characters, and eight is the minimum where a password is only one part of multi-factor authentication.
The Cybersecurity and Infrastructure Security Agency (CISA) says that the only widely available phishing-resistant authentication is FIDO/WebAuthn, and that any MFA is better than no MFA. For organizations not ready for phishing-resistant MFA, CISA suggests number matching to block push bombardment and SMS-based attacks.
State enforcement has targeted the same problem. On 5 January 2022 the New York Attorney General reported that credential stuffing attacks had compromised more than 1.1 million online accounts across 17 well-known companies. The office named three safeguards as highly effective: bot detection, multi-factor logins, and passwordless sign-in. In September 2020 a Dunkin' settlement with the same office carried $650,000 in penalties and costs, plus a requirement to reset affected customers' passwords.
| Source | Position | Date |
|---|---|---|
| NIST SP 800-63B-4 | 15 characters minimum for single-factor passwords; blocklist required | Current edition |
| CISA, MFA guidance page | FIDO/WebAuthn is the only widely available phishing-resistant option | Current page |
| New York Attorney General | 1.1 million accounts, 17 companies; bot detection, MFA, passwordless | 5 January 2022 |
| New York Attorney General, Dunkin' | $650,000 in penalties and costs | 15 September 2020 |
Guidance has moved from complex passwords toward blocklists, length and a second factor.
The Bottom Line
Credentials show up in 39% of the breaches in Verizon's 2026 DBIR, even though they were the first step in only 13%. HIBP now holds 17.8 billion breached account records, and a credential leak preceded ransomware within 95 days for half the victims that had one. Small organizations are not spared, with a median of seven credential leak events a year.
For a site owner, the practical reading is to treat every login you hold as a target. Check new passwords against a blocklist, require MFA on remote access and admin accounts, and watch for spikes in failed logins. Your privacy policy should also describe the account and authentication data you collect and how you protect it, and you can generate a privacy policy as a starting point that matches your own practices. This page is general information, not legal advice, and meeting a security standard does not guarantee you avoid a breach or a regulatory finding.
Frequently Asked Questions
What percentage of breaches involve stolen credentials? Verizon's 2026 Data Breach Investigations Report found credential abuse at some point in 39% of breaches, and as the first step in 13% of breaches, down from 22% in the 2025 report. Credentials themselves were among the data taken in 28% of breaches.
How many stolen accounts are in Have I Been Pwned? As of 3 November 2026, Have I Been Pwned lists 1,049 breached websites and 17,847,746,941 breached account records. A count of its public breach list shows 674 of those breaches included passwords, covering 11,795,478,211 account records.
How soon before a ransomware attack do credentials leak? Verizon found that 27% of ransomware victims had no infostealer or credential leak in the prior year, but among those that did, 50% had a credential or infostealer event within 95 days before the attack.
Does NIST still recommend forced password changes? No. NIST SP 800-63B-4 says verifiers must not require periodic password changes, must not impose composition rules, and must check new passwords against a blocklist of commonly used or compromised passwords. Single-factor passwords must be at least 15 characters.
Where the Numbers Come From
- Verizon: 2026 Data Breach Investigations Report. 31,000+ incidents, 22,000+ breaches, 145 countries, 39%, 13%, 22%, 31%, 16%, 6%, 28%, ransomware and credential leak timing (n=4,395), 44% VPN access offers (n=876), small versus larger organization leak events.
- Have I Been Pwned: home page totals. 1,049 pwned websites and 17,847,746,941 pwned addresses, as shown on 3 November 2026.
- Have I Been Pwned: public breach list (API v3). Per-breach counts, descriptions for Synthient, ALIEN TXTBASE and the June 2026 stealer logs; the 674 password-bearing breaches, 11.8 billion records and yearly counts are our own tallies of this list.
- NIST: SP 800-63B-4, Digital Identity Guidelines, Authentication and Authenticator Management. Blocklist, 15 and 8 character minimums, no composition rules, no periodic changes.
- CISA: Multifactor Authentication guidance. FIDO/WebAuthn as the phishing-resistant standard, number matching.
- New York Attorney General: Attorney General James alerts 17 companies to credential stuffing cyberattacks (January 2022). 1.1 million accounts, 17 companies, three safeguards.
- New York Attorney General: Dunkin' settlement (September 2020). $650,000 in penalties and costs, password resets.
Note: All figures verified as of November 2026. HIBP totals change as new breaches are added, and the 2026 yearly count is partial.
