Universities are the most exposed institutions in the stealer-log economy. 99.3% of the 295 universities in our 36-country panel have credentials on their email domain in stealer logs, the median university has 127, and 93.2% gained new ones in the 30 days to 13 October 2026. Between them they account for 11,989 of the 24,826 new employee credentials captured across the whole panel that month, 48% of the total from 16% of the organisations. The reason is students, and the consequence is that a university login is the easiest institutional identity to buy.
How exposed are universities?
Almost totally. Of the 295 universities measured, only two have no credential in the index at all, while 171 have a hundred or more and 19 have a thousand or more; the mean is 309 against the median of 127, which says that a minority of very large institutions carry tens of thousands of records between them. The comparison with the rest of the panel is stark: 89.4% of all organisations are exposed with a median of 31, government bodies sit at 76.3% with a median of 12, and banks at 88.7% with a median of 27. Universities are the only sector in which exposure is effectively universal.
The flow matters more than the stock. In the 30 days before the snapshot 11,989 university credentials were first indexed, 93.2% of universities gained at least one, and 69.2% gained one in the final seven days alone. A university security team that checks its domain once a term is looking at a list that changed last week.
| Group | Organisations | With credentials in stealer logs | Median per organisation | Gained new credentials in 30 days | Gained new in 7 days |
|---|---|---|---|---|---|
| Universities | 295 | 99.3% | 127 | 93.2% | 69.2% |
| All organisations | 1,856 | 89.4% | 31 | 53.2% | 34.3% |
| Large listed companies | 1,085 | 89.1% | 32 | 51.7% | 33.6% |
| Hospitals and health systems | 48 | 95.8% | 45 | 50.0% | 29.2% |
| Government and law enforcement | 279 | 76.3% | 12 | 31.5% | 12.9% |
Which countries' universities are most exposed?
North American and British universities carry the most. The median university in the United States has 734.5 exposed credentials and the median Canadian one 729.5, followed by Italy (456.5), Saudi Arabia (412.5), the United Kingdom (410), the United Arab Emirates, Turkey, Brazil, South Korea and Spain, all above 300. Hit rates are 100% in 34 of the 36 countries; only Israel (87.5%) and Lithuania (85.7%) have a university with nothing in the index. The lowest medians are in Lithuania (9), Japan (13), Denmark (22), Latvia (23) and Austria (29.5), which track the national pattern rather than anything specific to higher education.
| Country | Universities | With credentials | Median per university | New credentials, 30 days | Gained new in 30 days |
|---|---|---|---|---|---|
| United States | 14 | 100.0% | 734.5 | 908 | 100.0% |
| Canada | 12 | 100.0% | 729.5 | 1,059 | 100.0% |
| Italy | 8 | 100.0% | 456.5 | 1,315 | 100.0% |
| Saudi Arabia | 6 | 100.0% | 412.5 | 324 | 100.0% |
| United Kingdom | 12 | 100.0% | 410 | 445 | 91.7% |
| United Arab Emirates | 5 | 100.0% | 394 | 35 | 80.0% |
| Turkey | 9 | 100.0% | 387 | 317 | 100.0% |
| Brazil | 10 | 100.0% | 318.5 | 477 | 100.0% |
| South Korea | 8 | 100.0% | 315 | 168 | 100.0% |
| Spain | 10 | 100.0% | 315 | 812 | 100.0% |
| India | 12 | 100.0% | 289 | 1,085 | 100.0% |
| Mexico | 8 | 100.0% | 187 | 1,231 | 87.5% |
| South Africa | 10 | 100.0% | 182.5 | 705 | 100.0% |
| Portugal | 6 | 100.0% | 173.5 | 214 | 100.0% |
| Belgium | 7 | 100.0% | 156 | 142 | 85.7% |
| Finland | 7 | 100.0% | 126 | 72 | 85.7% |
| Australia | 12 | 100.0% | 123 | 531 | 100.0% |
| Nigeria | 8 | 100.0% | 118.5 | 363 | 100.0% |
| Netherlands | 10 | 100.0% | 112 | 424 | 100.0% |
| Norway | 6 | 100.0% | 91.5 | 48 | 100.0% |
| Germany | 8 | 100.0% | 89.5 | 154 | 100.0% |
| Singapore | 5 | 100.0% | 84 | 159 | 80.0% |
| France | 7 | 100.0% | 75 | 147 | 100.0% |
| Estonia | 4 | 100.0% | 72.5 | 8 | 75.0% |
| Poland | 10 | 100.0% | 61 | 176 | 100.0% |
| Czechia | 7 | 100.0% | 57 | 40 | 100.0% |
| Sweden | 9 | 100.0% | 54 | 118 | 100.0% |
| Switzerland | 8 | 100.0% | 53 | 92 | 100.0% |
| Ireland | 7 | 100.0% | 50 | 62 | 100.0% |
| Israel | 8 | 87.5% | 45 | 99 | 75.0% |
| Ukraine | 6 | 100.0% | 38.5 | 6 | 33.3% |
| Austria | 8 | 100.0% | 29.5 | 40 | 75.0% |
| Latvia | 5 | 100.0% | 23 | 4 | 40.0% |
| Denmark | 7 | 100.0% | 22 | 100 | 100.0% |
| Japan | 9 | 100.0% | 13 | 85 | 100.0% |
| Lithuania | 7 | 85.7% | 9 | 24 | 71.4% |
Why do students make universities the softest target?
Because the student body uses the institutional email domain on machines nobody manages. A student registers for Autodesk, Zoom, Canvas, Discord, GitHub and a dozen other services with a .edu or .ac address, saves the passwords in a browser on a personal laptop, and at some point that laptop runs a cracked copy of Adobe or a game cheat carrying LummaC2 or Vidar. The stealer takes every saved password, and the log that reaches the market now contains working credentials on the university’s domain, often including the single sign-on password that also opens the library, the student record system and, where the institution has not separated them, staff systems and research networks. The pattern is visible in the services table: the software most often captured alongside university logins is student software.
Staff are in the same logs for a different reason: academics work from personal devices more than almost any other profession, travel with them, and keep institutional logins for years. The index does not distinguish a professor from a first-year, which is why the figures on this page are described as staff and student credentials rather than employee credentials, and why the medians are so much higher than in companies with managed fleets.
What do the stolen university logins open?
Autodesk first, then the collaboration stack, then the identity layer. Across the 291 universities with such records the index holds 17,490 Autodesk logins across 237 institutions, 9,666 Zoom logins across 253, 4,887 Adobe Experience Cloud, 3,219 Dropbox Business, 2,839 OpenAI logins across 203 universities, 2,670 GitHub, 2,468 iCIMS (the recruiting platform, which is a staff system), 2,108 Miro, 1,914 Cisco cloud, 1,897 Canva, 1,829 Okta logins across 13 universities, 1,594 Discord, 1,441 JetBrains, 1,433 Notion, 1,374 Instructure Canvas, 1,216 Slack, 1,175 Webex and 1,103 Qualtrics. Most of that list is harmless on its own. Okta, GitHub, Slack and iCIMS are not: an Okta password with its session cookie is the key to everything behind the university’s single sign-on, GitHub tokens open research code and credentials committed with it, and iCIMS holds applicant data.
Free tool
How does your own site score?
Run the same forty passive checks against your own domain: TLS and certificates, security headers, SPF and DMARC, cookies before consent, and what your stack quietly reveals. A grade out of 100 in about fifteen seconds.
No signup. Nothing installed. We only request what your site already serves publicly.
| Service | Captured logins | Universities |
|---|---|---|
| Autodesk Construction Cloud | 17,490 | 237 |
| Zoom | 9,666 | 253 |
| Adobe Experience Cloud | 4,887 | 221 |
| Dropbox Business | 3,219 | 207 |
| OpenAI | 2,839 | 203 |
| GitHub | 2,670 | 190 |
| iCIMS | 2,468 | 83 |
| Miro | 2,108 | 172 |
| Cisco cloud services | 1,914 | 78 |
| Canva | 1,897 | 104 |
| Okta | 1,829 | 13 |
| Discord | 1,594 | 139 |
| JetBrains | 1,441 | 159 |
| Notion | 1,433 | 159 |
| Instructure Canvas | 1,374 | 70 |
Why this matters beyond the campus
Universities are among the most frequently confirmed ransomware victims in our education sector data, and the entry point in a large share of those cases is a stolen login rather than an exploited server. A university identity is also a credential for the wider world: it carries discounts, trust and, through federated login, access to journals, national research infrastructure and partner institutions. The 1,829 Okta logins across 13 universities in this snapshot, and the thousands of GitHub and Slack logins, are the records that turn a student’s infected laptop into an institutional incident, which is how stealer logs power modern ransomware attacks.
What should universities do?
Separate the domains where possible, so that a student account is never a staff account; many institutions already issue students a distinct subdomain, and the index then counts them apart. Treat single sign-on and identity-provider logins as incidents when they appear in a log, revoke the sessions so the stolen cookie stops working, and enforce phishing-resistant MFA for staff. Shorten session lifetimes and bind sessions to managed devices for anything that touches research data or student records. Check the institution’s domain monthly with Stealercheck, which returns the lifetime, 30-day and 7-day counts for free, and tell students plainly where the infections come from: cracked software, game cheats and fake installers. Our guide to cookie theft and MFA bypass explains why the password reset alone is not enough.
Frequently asked questions
How many universities have logins in stealer logs?
99.3% of the 295 universities measured in 36 countries in October 2026, with a median of 127 staff and student credentials per institution. Only two universities in the panel had nothing in the index.
Why are university figures so much higher than company figures?
Students share the institutional email domain and use it on unmanaged personal laptops, where infostealers spread through cracked software and game cheats. The counts therefore include student accounts, and a large university has tens of thousands of them.
Which countries' universities are most exposed?
By median credentials per institution: the United States (734.5), Canada (729.5), Italy (456.5), Saudi Arabia (412.5) and the United Kingdom (410). Hit rates are 100% in 34 of 36 countries.
What do the stolen university logins give an attacker?
Mostly student software such as Autodesk, Zoom and Canvas, but also 1,829 Okta logins across 13 universities, 2,670 GitHub logins and 1,216 Slack logins in the October 2026 snapshot. An identity-provider login with its session cookie opens everything behind single sign-on.
Does this mean these universities were hacked?
No. A stealer-log record is produced on an infected device, usually a personal laptop on which a student or staff member saved their university password. It means the credential is in criminal hands, not that the university’s systems were breached, although it is how many university breaches begin.
Why are no universities named?
Ransomnews publishes per-organisation figures for companies only. Naming an exposed university, hospital or government body helps attackers more than defenders, so those sectors appear in aggregate. Any institution can check its own domain with Stealercheck.
Sources and further reading
- Universities: infostealer statistics: the live sector page, with the country breakdown and services
- Infostealer statistics: the dataset, methodology and public API
- Infostealer exposure by country: all 36 countries ranked
- Confirmed ransomware attacks on education: the sector’s confirmed incidents since 2018
- Stealer logs explained: what a log holds and how it leaks
- BleepingComputer: Lumma infostealer malware operation disrupted, 2,300 domains seized, 21 May 2025
The Ransomnews Monthly
One email a month. Original leak-site data, victim census updates, and the findings that did not make the articles. No spam, unsubscribe any time.
Double opt-in. We store your email, signup time, and IP for consent records (GDPR Art. 7). See our privacy policy.