Credential theft has surged 160% in 2025

Credential theft now accounts for one-in-five data breaches, with the number of compromised credentials skyrocketing.

Analysis from Check Point shows the volume of compromised credentials has surged 160% so far in 2025. The cybersecurity giant said in one month alone it reported 14,000 cases where employee credentials were exposed in data breaches.

This big increase in numbers, researchers noted, could be down to the increasing use of AI improving the sophistication of phishing attacks, along with an increasing number of stealer families.

These are making it easier for less-experienced threat actors to enter the playing field by using Malware as a Service offerings on the dark web.

The research also found that, in cases where stolen credentials originate from GitHub repositories, it takes an average of 94 days for businesses to remediate the leaked secrets by revoking them or disabling affected accounts.

"This suggests that businesses struggle to identify leaked login information quickly, giving threat actors plenty of time to take advantage of it," researchers said.

There was quite a bit of variation in the rates for different countries. Brazil and India were big outliers, with rates of 7.64% and 7.10% respectively. The rest of the top ten included Indonesia, Vietnam, Pakistan, Egypt, the US, the Philippines, Türkiye, and Argentina, all with rates of between 4.3% and 3%.

As for the websites and domains most frequently impacted by leaked credential attacks, those owned by Discord, Microsoft - which owns live.com - and Facebook top the list. Gmail and Roblox accounts are also frequently implicated.

According to Verizon’s 2025 Data Breach Investigation Report, stolen credentials were the root cause of 22% of data breaches in 2024.

Unlike software vulnerability exploits or malware deployment, stolen credentials are a particularly easy method of attack, said Check Point.

"Once threat actors obtain the credentials for a legitimate user – which they can do by breaking into databases or launching phishing attacks, among other methods – they can simply log in as if they were that user. In turn, they can access any resources available to that user," the researchers said.

"And they can typically do so without being easily detected, since they are not bypassing security controls or disabling systems."

How to prevent credential theft

There's not much that organizations can do to completely prevent the theft of login credentials. Even anti-phishing tools and email gateways are no guarantee, researchers noted.

However, Check Point recommends tightening up password management policies, implementing multi-factor authentication (MFA), and where possible prioritizing single sign-on (SSO) over direct credential logins.

Login attempts should be limited to prevent brute-force attacks and cross-account credential stuffing, it recommends, and user access rights should be limited to the bare minimum necessary. Employees should be trained to recognize and resist phishing attempts.

Similarly, network-level protections, such as intrusion detection systems and firewalls, should be used, while access to third-party websites should be restricted.

Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.

MORE FROM ITPRO

• Employee phishing training is working – but don’t get complacent
• Phishing tactics: The top attack trends
• Hackers are using Microsoft 365 features to bombard enterprises with phishing emails