The numbers are staggering: credential theft has surged 160% in 2025 compared to last year. According to Check Point External Risk Management and Flashpoint's Global Threat Intelligence Index, 1.8 billion credentials were stolen in just the first half of 2025 from 5.8 million infected devices.

This isn't a gradual increase. This is an explosion.

The scope of the problem

Let's put this in perspective:

Metric Value
Credential theft increase 160% vs 2024
Logins stolen (H1 2025) 1.8 billion
Infected hosts 5.8 million
Breaches initiated by leaked credentials 22% (Verizon 2025 DBIR)
Average remediation time 94 days

The most dramatic incident? In June 2025, researchers discovered what's been dubbed the "G.O.A.T. of all data breaches"—a massive cache containing 16 billion login records exposed online, including credentials for Facebook, Apple, and Google accounts.

December 2025: The breaches keep coming

Just this week, more high-profile breaches have surfaced:

CodeRED emergency alert system breach

The nationwide emergency notification system used by millions of Americans was compromised in early December 2025. The INC Ransom group posted screenshots showing stolen customer data including email addresses and—disturbingly— clear-text passwords.

Harvard University breach

On November 22, 2025, Harvard confirmed that its Alumni Affairs and Development Office was compromised through a phone-based phishing attack. An attacker used social engineering to obtain credentials, then accessed donor records, event attendance data, and personal contact information.

Mixpanel analytics breach

Analytics giant Mixpanel disclosed a security incident affecting customers including OpenAI. The full scope remains unclear, but user names, email addresses, and device identifiers may have been exposed.

Why is this happening now?

Three factors are converging to create perfect conditions for credential theft:

1. AI-powered phishing at scale

Attackers are using AI to generate highly convincing phishing emails that are nearly indistinguishable from legitimate communications. What used to require skilled social engineers can now be automated and scaled to millions of targets.

2. Malware-as-a-Service explosion

The underground economy for stealing credentials has professionalized. "Stealer" malware families are now available as subscription services on the dark web, complete with dashboards, customer support, and regular updates.

3. The remediation gap

Here's a number that should worry every security professional: organizations take an average of 94 days to remediate compromised credentials originating from GitHub repositories.

By the time most organizations act, the damage is done.

Which platforms are most targeted?

The research reveals which services see the most credential theft:

  1. Discord
  2. Microsoft (live.com)
  3. Facebook
  4. Gmail
  5. Roblox

The cascade effect: Why one breach matters

Stolen credentials don't just affect the compromised service. They cascade:

Compromised Gmail account
    → Password reset access to: Banking, shopping, healthcare
    → Email contents reveal: Other services used, personal info
    → Two-factor bypass: Many sites text/email 2FA codes
        → Full account takeover across dozens of services

Geographic hotspots

Credential theft rates are highest in:

  • Brazil
  • India
  • Vietnam, Pakistan, Turkey

What attackers do with stolen credentials

Immediate exploitation

  • Account takeover (ATO)
  • Spam and bot networks
  • Credential stuffing

Longer-term monetization

  • Combo lists
  • Corporate access
  • Extortion

Cascade attacks

Attackers increasingly use personal credentials to access corporate systems:

  1. Compromise personal Gmail account
  2. Find emails from employer
  3. Access corporate password reset functionality
  4. Gain internal system access

The 94-day problem

Check Point's research highlights a critical metric: 94 days is the average time to remediate credentials exposed in GitHub repositories.

How to protect yourself

Essential defenses

  1. Multi-factor authentication (MFA)
  2. Password managers
  3. Single sign-on (SSO)
  4. Regular credential rotation

Advanced measures

  1. Dark web monitoring
  2. Network intrusion detection
  3. Least privilege access
  4. Employee security training

Why we built The Password App

This 160% surge in credential theft isn't slowing down. AI is making attacks more sophisticated. Malware-as-a-Service is lowering barriers. The 94-day gap shows that even organizations with security teams struggle to keep up.

That's why we built The Password App: AI that handles the tedious clicking so you actually rotate your passwords.

Take action today

The 160% surge isn't an abstraction. It's 1.8 billion real credentials—potentially including yours—circulating in underground markets right now.

  • Password uniqueness
  • Response time
  • MFA everywhere

Sources