Employee credentials captured by infostealer malware exist for 89.6% of the 1,856 large organisations in our 36-country panel, and 55.5% of them gained at least one new stolen login in the 30 days to 1 November 2026, up from 53.2% in October. The panel added 28,473 employee credentials in that window, 15% more than the month before. This is the first month-on-month edition of the Ransomnews Infostealer Exposure Dataset.

What changed since October

• New employee credentials in the 30-day window rose from 24,826 to 28,473, and the share of organisations that gained one in the final seven days jumped from 34.3% to 45.4%.
• Telefónica added 1,152 employee credentials in the window, 897 of them in the last week of October, the largest single batch in either snapshot. It took Spain’s monthly total from 1,220 to 2,310.
• Universities kept climbing with the new academic year: 94.9% gained new credentials in the month and 86.1% in the final week, against 69.2% a month earlier.
• Vidar added more records to the index than any other family (132,257), ahead of LummaC2 (96,868) and Acreed (79,612). Acreed’s share rose by 0.36 points to 5.2%, the largest gain of any family.
• The headline rates barely moved: 1,663 organisations exposed against 1,659, a median of 32 credentials against 31. Exposure accumulates; it does not reset.

How many organisations have employee logins in stealer logs?

Nine in ten. Of the 1,856 organisations measured for employee exposure, 1,663 (89.6%) have at least one staff email address with a password captured by infostealer malware on an infected device, and the typical organisation has 32 such credentials in circulation. The distribution is long-tailed: 193 organisations (10.4%) have none, 552 (29.7%) have a hundred or more, and 72 (3.9%) have a thousand or more. Net of movements, four more organisations had some exposure than in October, and seven more had a hundred credentials or more.

The flow is where the change shows. In the 30 days before the 1 November snapshot the index added 28,473 employee credentials for panel domains, about 950 a day, and 1,030 organisations (55.5%) gained at least one. The October report counted 24,826 and 988. Because the two snapshots were taken 19 days apart, on 13 October and 1 November, the two 30-day windows overlap by eleven days; the comparison shows direction and scale, not two clean calendar months, and from December the snapshots fall early in each calendar month.

Group	Organisations	With employee credentials	Median per organisation	New in 30 days	New in 7 days	New in 30 days, October
All organisations	1,856	89.6%	32	55.5%	45.4%	53.2%
Large listed companies	1,085	89.4%	33	54.5%	43.3%	51.7%
Universities	295	99.3%	134	94.9%	86.1%	93.2%
Hospitals and health systems	48	95.8%	45	50.0%	45.8%	50.0%
Government and law enforcement	279	76.7%	12	34.8%	25.1%	31.5%
Start-ups	44	81.8%	19	36.4%	25.0%	47.7%

Which infostealer families produce the logs?

LummaC2 holds 31.6% of the 17,184,098 stealer-log records in the index, ahead of RedLine (24.0%), Vidar (23.5%) and StealC (10.7%). The index grew by 384,412 records between the snapshots, and for the first time we can say which families supplied them: Vidar added 132,257, LummaC2 96,868, Acreed 79,612, RedLine 34,676 and StealC 34,164. Acreed, the family that gained ground after the May 2025 Lumma disruption, contributed a fifth of the new records from a base of under 5%, which is why its share rose by 0.36 points to 5.2%. RedLine’s share fell by 0.34 points; its stock is large, its new supply is small.

Read the shares as stock and the additions as flow. RedLine’s quarter of the index reflects years at the top of the market before the October 2024 Operation Magnus takedown, not its output now, while the month’s additions are the nearest thing this index offers to a measure of who is infecting machines today. On that measure Vidar, Lumma and Acreed account for 80% of what arrived, which matches the fresh-volume picture in our 2026 family guide. The macOS stealers grouped as MacSync/SHub added only 3,285 records and slipped to 2.6%.

Which countries are most exposed?

The United States, India and Brazil, by a distance. The median US organisation in the panel has 609 employee credentials in stealer logs, the median Indian organisation 209 and the median Brazilian one 173; no other country’s median reaches 75. Spain (74), France (72), Turkey (71), Mexico (65), South Africa (63.5), Canada (62) and the United Kingdom (57) make up the next tier. At the other end sit Estonia (2), Latvia (6), Lithuania (7.5), Ukraine (10.5), Ireland (13.5), Japan (14), Czechia and Denmark (14.5 each), with Singapore and Austria close behind.

Two effects drive the ranking and neither is purely national hygiene. The first is headcount: the US panel is drawn from the largest employers on earth, so the same infection rate per employee produces a far larger count, and the median US company (624) sits more than twenty times above the median company elsewhere (27). The second is where the logs come from: stealer operators and the Telegram markets that trade their output have historically harvested far more from the Americas and South Asia than from Northern Europe. Hit rates are tighter than medians: 98.6% of US organisations, 97.9% of Turkish and 97.5% of Saudi ones have at least one exposed employee, against 71.0% in Estonia, 72.4% in Latvia and 75.0% in Lithuania; Estonia and Lithuania each added one exposed organisation in the month.

The 30-day column is where countries diverge. Spain almost doubled its new employee credentials, from 1,220 to 2,310, almost entirely because of Telefónica. The United States rose from 4,241 to 4,977, Canada from 1,333 to 1,559 and the United Kingdom from 938 to 1,161, while India, Italy, Mexico and Germany fell back. By share of organisations gaining new credentials, India (81.2%), Brazil (77.0%), the United States and Canada (76.1% each) lead; Latvia (13.8%), Ukraine (14.3%) and Estonia (16.1%) are lowest, consistent with the infected machines behind these logs being personal devices in countries where the big stealer families are distributed most aggressively through cracked software and malvertising.

Country	Organisations	With employee credentials	Median per organisation	New credentials in 30 days	October	Gained new credentials in 30 days
United States	138	98.6%	609	4,977	4,241	76.1%
India	69	94.2%	209	3,477	3,626	81.2%
Spain	46	95.7%	74	2,310	1,220	67.4%
Canada	71	91.5%	62	1,559	1,333	76.1%
Italy	46	91.3%	44.5	1,523	1,622	65.2%
Mexico	55	92.7%	65	1,470	1,661	65.5%
Brazil	61	95.1%	173	1,218	965	77.0%
United Kingdom	73	90.4%	57	1,161	938	64.4%
Australia	68	91.2%	23.5	1,141	1,043	54.4%
France	55	94.5%	72	956	899	74.5%
Germany	55	92.7%	45	563	666	61.8%
Japan	67	82.1%	14	266	180	35.8%
Ukraine	42	78.6%	10.5	14	10	14.3%
Estonia	31	71.0%	2	14	12	16.1%

Which sectors are most exposed?

Universities are the most exposed institutions in every country we measured, and government bodies the least. 99.3% of the 295 universities in the panel have credentials on their email domain in stealer logs, the median rose from 127 to 134, and the panel’s universities added 14,147 new credentials in the month, half of the whole panel’s total; students share the domain, and October is when a new intake starts logging into university services on personal laptops. Government and law-enforcement bodies sit at the bottom on every measure: 76.7% exposed, a median of 12, and 34.8% gaining new credentials in the month, which reflects managed devices and, in suffix domains such as gov.uk, the fact that the index counts each agency domain separately.

Sector	Organisations	With employee credentials	Median per organisation	Gained new credentials in 30 days	October
Universities	295	99.3%	134	94.9%	93.2%
Pharmaceuticals	35	94.3%	196	74.3%	62.9%
Technology	102	94.1%	58.5	68.6%	68.6%
Hospitals and health systems	48	95.8%	45	50.0%	50.0%
Industrial	93	87.1%	39	61.3%	64.5%
Telecoms	94	89.4%	31.5	53.2%	55.3%
Banking and finance	213	89.7%	28	43.2%	42.3%
Airlines and transport	90	95.6%	27.5	47.8%	38.9%
Retail	100	78.0%	19.5	49.0%	46.0%
Media	134	97.8%	16	26.9%	25.4%
Government and law enforcement	279	76.7%	12	34.8%	31.5%

Among companies, pharmaceuticals carry the highest median (196 on a panel of 35, pulled up by the eight US majors, whose own median is 690 against 57 for the rest) and moved most among the larger sectors: 74.3% gained new credentials, up from 62.9%. Telecoms doubled its new credentials, from 1,053 to 2,041, but on one company’s batch; the share of telecoms gaining any new credential actually fell. Banking and finance is still the quietest commercial sector, with a median of 28 and 43.2% gaining new credentials, which is what a decade of regulator-driven device management buys. Retail has the lowest hit rate of any commercial sector at 78.0%, not because retailers are better defended but because store and warehouse staff rarely have corporate email at all.

What do the stolen employee logins open?

Salesforce, Okta and GitHub, before anything else. A stealer takes every saved password on the machine, so the same log that contains an employee’s email login usually contains the logins to the company’s cloud services, and the index records which third-party services appear alongside each organisation’s email domain. Across the 713 companies with such records, Salesforce CRM logins (13,897 across 204 companies) lead by a wide margin, followed by Okta (4,508 across 111 companies), Cisco cloud services (3,611), Adobe Experience Cloud (3,090), GitHub (3,007 across 111 companies), Webex (2,245), Discord (2,157), Zoom (1,874), Box (1,385), SAP S/4HANA Cloud (1,321), Dropbox Business (1,304) and Amazon Web Services (987 across 77 companies). Every one of those counts rose in the month.

The sector mix is the finding, and it held steady. In banking and finance, half of all captured third-party logins (49.8%) are CRM logins, almost entirely Salesforce; in hospitals and health systems CRM is 35.9% and identity providers 12.4%; in technology companies CRM is 27.8%, with source control (8.2%), network security consoles (6.9%) and identity providers (6.9%) behind it. Government bodies look different: video conferencing (28.8%) and team chat (22.3%) dominate, and the index holds 442 OpenAI logins registered with government email addresses across 20 public bodies, out of 4,008 OpenAI logins across 319 organisations in the whole panel. Universities are dominated by Autodesk (17,971 logins across 237 institutions), Zoom and Canvas, which is student software and explains why “Construction & Design” tops the all-panel chart above.

An Okta or other identity-provider password in a stealer log is the most dangerous single record in this dataset. It is the key to every application behind the company’s SSO, and the stealer typically captures the session cookie next to it, which is why cookie replay rather than password reuse is now the common first step. The 6,850 identity-provider logins across 129 organisations in this snapshot, up from 6,696 across 127, are the number we would put in front of any CISO before the headline hit rate.

Which companies gained the most new stolen employee logins?

Telefónica, by a factor of three. Per-organisation figures are published for companies only; government, university and healthcare bodies appear in aggregates. The table ranks the panel’s companies by employee credentials first indexed in the 30 days to 1 November 2026. These are logins captured from infected devices on which staff had saved their work passwords, usually personal or unmanaged machines; they are not evidence that the company’s own systems were breached, and every company on the list is large enough that a few hundred infected endpoints among its workforce and contractors is a rounding error on headcount.

Company	Country	Sector	New employee credentials, 30 days	October	Employee credentials, all time
telefonica.com	ES	Telecoms	1,152	288	6,716
google.com	US	Technology	381	369	4,371
ibm.com	US	Technology	313	256	3,106
wipro.com	IN	Technology	289	289	5,473
tcs.com	IN	Technology	269	256	4,096
amazon.com	US	E-commerce	246	217	4,273
bajajfinserv.in	IN	Finance	239	273	686
linkedin.com	US	Technology	218	198	275
salesforce.com	US	Technology	193	172	1,028
techmahindra.com	IN	Technology	190	212	3,874
infosys.com	IN	Technology	155	163	1,978
rappi.com	MX	Technology	135	110	3,159

Telefónica’s jump is a batch, not a trend: 897 of its 1,152 new credentials were indexed in the final seven days of October, and its lifetime count rose by 899 between the snapshots, from 5,817 to 6,716. A single large log dump from one campaign or one reseller produces exactly that shape, and it is the most useful kind of signal for a security team because the affected accounts are fresh. The rest of the table is steadier. Four of the twelve are Indian IT-services and outsourcing groups, Wipro, TCS, Tech Mahindra and Infosys, which between them run a large share of the world’s corporate help desks, cloud migrations and application support; a stolen @wipro.com or @tcs.com login is rarely valuable for what it opens at Wipro or TCS, and often valuable for the client environments those staff administer. LinkedIn stands out for momentum, with 218 new credentials against a lifetime total of 275.

What about consumer accounts and cookies?

The consumer side dwarfs everything above it. The index holds 22.6 million stolen Google logins, 13.5 million Facebook, 11.4 million Roblox, 6.2 million Discord, 6.1 million Instagram, 3.8 million Netflix, 3.6 million Amazon and 2.4 million Apple, and in the 30 days to 1 November it added 877,039 Google logins, 428,000 Facebook and 299,914 Roblox. Those are customers’ saved passwords captured on infected home machines, not breaches of the brands. Alongside them sit 1.18 billion session cookies tied to panel domains, 49.3 million of them captured in the month; a valid cookie lets an attacker resume a logged-in session without the password or the MFA prompt, which is why the cookie count, not the password count, is the number that bears on account takeover.

What should security teams do with these numbers?

Check your own domain, then act on the fresh records rather than the lifetime total. The free Stealercheck lookup returns the same exposure counts for any domain, so the first step is to compare your organisation against the medians above for its country and sector. A total far above the median almost always means staff saving corporate passwords in browsers on personal or unmanaged devices, which no server-side control addresses.

For every exposed account the sequence is the same: reset the password, revoke every active session so stolen cookies stop working, enforce re-enrolment of MFA, and find the infected device, because a stealer log is evidence of a compromised endpoint rather than a leaked database. Treat identity-provider logins as incidents in their own right. Then shorten session lifetimes on SSO, bind sessions to device posture where the identity provider supports it, block browser password saving for corporate accounts in favour of a managed password manager, and watch the categories in this report for your sector: if you are a bank, your exposed Salesforce logins are half of everything captured. If a batch like Telefónica’s lands on your domain, treat it as one incident, not hundreds of separate resets.

What this means for the ransomware supply chain

Every number in this report is inventory for initial access brokers. The 28,473 employee credentials added in a month are the raw material that brokers filter for VPN, RDP, Citrix and SSO logins at organisations worth extorting, and the Ransomtracker feed of leak-site claims is what the other end of that pipeline looks like a few weeks later. In October that pipeline was visible in individual cases: Stadler Rail’s July breach came through compromised logins on a platform shared with a supplier, and the same index holds 50 infostealer-captured staff credentials for stadlerrail.com; the group blamed for it, Everest, went on to list the builder of the Brenner Base Tunnel in October, as we set out in Everest listed Brenner Base Tunnel 20 days before the news. With two snapshots stored, the monthly deltas can now start testing the larger hypothesis: that sectors and countries whose employee exposure rises are the ones whose confirmed attacks rise a quarter later.

The caveat is that this is one index. It is large, it is live, and it is the same one that powers the lookup tool, but no index sees every log, the lifetime counters report a floor of one that we treat as zero, and the panel is a curated set of large institutions rather than a sample of all organisations. Month-on-month change on a fixed panel is the signal to watch; the absolute figures are a defensible minimum, not a census.

How we measured this

On 1 November 2026 we queried the Alerts.bar infostealer index for the same fixed panel of 1,874 organisation domains in 36 countries used in the first snapshot on 13 October, chosen from each country’s largest listed companies, principal banks, telecoms and utilities, central government and law-enforcement bodies, leading universities, major hospital systems and national media, plus a 21-brand consumer panel. For each domain we stored the lifetime, 30-day and 7-day counts of stealer-log credentials for staff and for users, session cookies, combolist records and breach datasets, and an aggregate summary of the third-party services where the domain’s accounts appear, summed from each organisation’s 25 largest services and 20 largest categories. Eighteen domains that host consumer mailboxes are excluded from every employee figure, duplicate catalogue entries for the same service are merged, and a lifetime counter of exactly one is recorded as zero. Family shares are taken from the index’s global family totals on each snapshot date. The full method, the live tables for all countries and sectors, and the public API are on the infostealer statistics page.

Frequently asked questions

Sources and further reading

• Infostealer statistics: the live dataset page, with all 36 countries, the sector tables, the consumer-brand panel and the public API behind this report
• Infostealer exposure by country: all 36 countries ranked, each with its own data page
• Universities and infostealers, government bodies in stealer logs and what stolen SaaS logins open: the sector reports built on the first snapshot
• Stealercheck: free domain lookup against the same index
• Top infostealer families in 2026: Lumma, RedLine, Vidar, StealC and the new entrants
• MFA bypass via cookie theft: why session cookies, not passwords, drive account takeover
• How stealer logs power modern ransomware attacks
• Ransomware statistics: confirmed attacks by month, the other end of the pipeline
• IRS Criminal Investigation: U.S. joins international action against RedLine and META infostealers, Operation Magnus, 29 October 2024
• BleepingComputer: Lumma infostealer malware operation disrupted, 2,300 domains seized, 21 May 2025

Reporting by the Ransomnews Research Team. All figures are aggregate counts from the Alerts.bar index, an independent provider whose data Ransomnews licenses; no credentials or personal data are stored or reproduced.