Government is the least exposed sector in the stealer-log economy, and still three quarters of it is exposed. 76.3% of the 279 central government, police and agency bodies in our 36-country panel have staff credentials in stealer logs, the median body has 12, and 31.5% gained new ones in the 30 days to 13 October 2026, against 89.4%, 31 and 53.2% for the panel as a whole. In 11 countries with five or more bodies in the panel every one of them is exposed; in Estonia, Latvia, Sweden and Finland fewer than half are. No public body is named on this page or anywhere on this site.
How exposed are government bodies?
Less than any other sector, on every measure. 66 of the 279 bodies have nothing in the index, 25 have a hundred or more credentials and two have a thousand or more; the mean is 60 against the median of 12. Only 31.5% gained a new credential in the month and 12.9% in the final week, against 53.2% and 34.3% across the panel, which is the clearest sign in the dataset of what managed devices and a ban on personal hardware buy. Universities, the opposite case, sit at 99.3% exposed with a median of 127.
Two measurement effects pull the government figures down and should be read before the ranking. The index matches exact registrable domains, so a national suffix such as gov.uk or gov.au counts only addresses on the bare domain, and departmental domains are measured individually where the panel lists them. And public servants use personal devices less, so the credentials that do appear tend to be older and to belong to the services the table below describes: meeting tools, chat and the odd ChatGPT account, rather than the systems of state.
| Group | Organisations | With credentials in stealer logs | Median per organisation | Gained new credentials in 30 days | Gained new in 7 days |
|---|---|---|---|---|---|
| Government and law enforcement | 279 | 76.3% | 12 | 31.5% | 12.9% |
| All organisations | 1,856 | 89.4% | 31 | 53.2% | 34.3% |
| Large listed companies | 1,085 | 89.1% | 32 | 51.7% | 33.6% |
| Hospitals and health systems | 48 | 95.8% | 45 | 50.0% | 29.2% |
| Universities | 295 | 99.3% | 127 | 93.2% | 69.2% |
Which countries' public bodies are most exposed?
Every public body measured is exposed in 11 countries with five or more bodies in the panel: Brazil, Mexico, the United States, South Africa, Turkey, Portugal, Italy, the United Kingdom, France, Nigeria and Spain. The deepest exposure is in Brazil (median 53), Mexico (47), the United States (44.5) and India (43, with 432 new credentials in the month, the most of any country’s public sector), followed by South Africa and Turkey (38 each) and Canada and Portugal (35.5 each). Australia is the odd case: only 69.2% of its 13 bodies are exposed, but those that are gained 426 new credentials in the month, the second-highest flow in the table.
| Country | Public bodies | With credentials | Median per body | New credentials, 30 days | Gained new in 30 days |
|---|---|---|---|---|---|
| Brazil | 8 | 100.0% | 53 | 105 | 62.5% |
| Mexico | 6 | 100.0% | 47 | 2 | 33.3% |
| United States | 10 | 100.0% | 44.5 | 50 | 70.0% |
| South Africa | 9 | 100.0% | 38 | 15 | 44.4% |
| Turkey | 7 | 100.0% | 38 | 20 | 71.4% |
| Portugal | 6 | 100.0% | 35.5 | 9 | 16.7% |
| Italy | 6 | 100.0% | 33 | 71 | 66.7% |
| United Kingdom | 6 | 100.0% | 20 | 13 | 83.3% |
| France | 6 | 100.0% | 14 | 8 | 33.3% |
| Poland | 4 | 100.0% | 12 | 1 | 25.0% |
| Nigeria | 9 | 100.0% | 11 | 33 | 44.4% |
| Spain | 6 | 100.0% | 8.5 | 1 | 16.7% |
| Israel | 3 | 100.0% | 6 | 49 | 66.7% |
| India | 10 | 90.0% | 43 | 432 | 60.0% |
| Saudi Arabia | 9 | 88.9% | 15 | 15 | 44.4% |
| South Korea | 8 | 87.5% | 21.5 | 13 | 37.5% |
| Canada | 12 | 83.3% | 35.5 | 61 | 58.3% |
| Switzerland | 5 | 80.0% | 14 | 2 | 40.0% |
| Netherlands | 8 | 75.0% | 16.5 | 10 | 25.0% |
| Norway | 8 | 75.0% | 7 | 9 | 12.5% |
| Ukraine | 8 | 75.0% | 2 | 2 | 25.0% |
| Lithuania | 10 | 70.0% | 5 | 1 | 10.0% |
| Australia | 13 | 69.2% | 12 | 426 | 23.1% |
| Belgium | 8 | 62.5% | 11.5 | 12 | 37.5% |
| Japan | 8 | 62.5% | 8.5 | 0 | 0.0% |
| Austria | 8 | 62.5% | 7 | 18 | 12.5% |
| Czechia | 8 | 62.5% | 3.5 | 0 | 0.0% |
| Singapore | 10 | 60.0% | 10 | 2 | 10.0% |
| Denmark | 7 | 57.1% | 10 | 14 | 14.3% |
| United Arab Emirates | 7 | 57.1% | 9 | 1 | 14.3% |
| Germany | 7 | 57.1% | 4 | 4 | 42.9% |
| Ireland | 7 | 57.1% | 3 | 1 | 14.3% |
| Finland | 9 | 44.4% | 0 | 15 | 11.1% |
| Sweden | 7 | 42.9% | 0 | 0 | 0.0% |
| Latvia | 8 | 37.5% | 0 | 12 | 25.0% |
| Estonia | 8 | 37.5% | 0 | 0 | 0.0% |
Why the least exposed sector is still the most attacked
Because one login is enough, and government has the second-longest ransomware record of any sector we track, behind only healthcare. The Ransomnews Confirmed Ransomware Attacks Dataset holds 1,519 independently confirmed ransomware attacks on government bodies between January 2018 and October 2026, across 108 countries, with LockBit the most active group and more than 12 million records exposed in the cases where a figure was disclosed; 614 of those victims publicly refused to pay and 61 are confirmed to have paid. Government, healthcare and education together account for well over a third of every confirmed incident in that dataset. A ministry with twelve exposed staff logins has twelve ways in, the attackers who buy from initial access brokers need one, and the stealer-log record is the only one of those entry points a security team can see before it is used, because the credential appears in the index before the intrusion.
The 30-day column is where that warning lives. The public sector added 1,427 staff credentials in the month to 13 October, and two countries produced 60% of them: India (432) and Australia (426). In the United Kingdom 83.3% of the bodies measured gained a new credential in the month and in the United States 70%, against 31.5% for the sector; Estonia, Sweden, Finland and Latvia, the countries where national eID has replaced passwords for most public-sector staff, added almost none, with medians of zero and fewer than half of their bodies exposed at all.
What do the stolen government logins open?
Meeting software, chat and, increasingly, AI accounts. Across the 108 public bodies with such records the index holds 1,802 Zoom logins across 20 bodies, 1,710 Discord logins across 14, 763 Adobe Experience Cloud, 636 Autodesk, 440 Webex across 33 bodies, 439 OpenAI logins across 20 bodies, 262 Canva, 190 Okta logins across eight bodies, 170 Dropbox Business, 138 Wix, 92 Cisco cloud, 60 GitHub across 11 bodies, 55 Miro, 45 Box, 44 SurveyMonkey and 41 BeyondTrust logins at a single body. By category, video conferencing is 28.8% of the total and team chat 22.3%, which says that the public servants whose logins end up in these logs were mostly using personal devices for meetings and messaging, not for the systems of state.
Three of those entries deserve attention. The OpenAI accounts are a records problem as much as a security one: a ChatGPT login registered with a government address exposes the conversation history, which for a working official may contain drafts and internal material that were never meant to leave the building. The Okta logins are, as everywhere, the key to everything behind single sign-on at the eight bodies concerned. And a BeyondTrust login, which is privileged-access software, is the one record on the list that opens administrative access directly. The 60 GitHub logins across 11 bodies point to public-sector developers committing code, and often secrets, from personal machines.
Free tool
How does your own site score?
Run the same forty passive checks against your own domain: TLS and certificates, security headers, SPF and DMARC, cookies before consent, and what your stack quietly reveals. A grade out of 100 in about fifteen seconds.
No signup. Nothing installed. We only request what your site already serves publicly.
| Service | Captured logins | Public bodies |
|---|---|---|
| Zoom | 1,802 | 20 |
| Discord | 1,710 | 14 |
| Adobe Experience Cloud | 763 | 24 |
| Autodesk | 636 | 16 |
| Webex | 440 | 33 |
| OpenAI | 439 | 20 |
| Canva | 262 | 9 |
| Okta | 190 | 8 |
| Dropbox Business | 170 | 21 |
| Wix | 138 | 7 |
| Cisco cloud services | 92 | 19 |
| GitHub | 60 | 11 |
| Miro | 55 | 12 |
| Box | 45 | 5 |
| SurveyMonkey | 44 | 5 |
| BeyondTrust | 41 | 1 |
Why government is the least exposed sector, and why that is not reassurance
Managed devices, no bring-your-own-device policies, separate networks and, in the best cases, passwordless identity: the public sector has spent two decades building exactly the controls that stealer malware defeats everywhere else, and the figures show it working. The reasons it is not reassurance are two. First, 76.3% is still three in four. A police force or ministry with twelve exposed staff logins has twelve ways in, and the attackers who buy from initial access brokers need one. Second, government is among the most frequently confirmed ransomware victims in our confirmed attacks data, which means the entry points exist regardless; the stealer logs are one of them, and the only one a security team can see coming, because the credential appears in the index before it is used.
What should public bodies do?
Monitor the domain, including every departmental subdomain, monthly: Stealercheck returns the lifetime, 30-day and 7-day counts for any domain without showing a credential. Treat any identity-provider, privileged-access or developer login in a log as an incident, revoke the sessions so the cookie dies, and find the device. Extend eID and phishing-resistant MFA to every system that still takes a password, which is the control that explains the Nordic and Baltic numbers. Decide what staff may do with a government address on a personal device, because the meeting, chat and AI logins in the table above are the trace of that decision never having been made. And remember that the figures on this page are aggregates by design; a body that wants to know its own position has to look.
Frequently asked questions
How many government bodies have staff logins in stealer logs?
76.3% of the 279 central government, police and agency bodies measured in 36 countries in October 2026, with a median of 12 credentials per body. Government is the least exposed sector in the panel; universities, at 99.3%, are the most.
Which countries' public bodies are most exposed?
Every body measured is exposed in 11 countries with five or more bodies in the panel, including Brazil, Mexico, the United States, South Africa, Turkey, Italy, the United Kingdom and France. By depth, Brazil (median 53), Mexico (47), the United States (44.5) and India (43) lead.
Which countries' public bodies are least exposed?
Estonia and Latvia (37.5% of bodies, median zero), Sweden (42.9%) and Finland (44.4%), where national eID and app-based login have replaced passwords for most public-sector staff.
What do stolen government logins give an attacker?
Mostly meeting and chat tools, but the October 2026 snapshot also holds 439 OpenAI logins across 20 bodies, 190 Okta logins across eight, 60 GitHub logins across 11 and 41 privileged-access logins at one body. An identity-provider login with its session cookie opens everything behind single sign-on.
Why are no government bodies named?
Because naming an exposed ministry, police force or agency helps attackers more than defenders. Ransomnews publishes per-organisation figures for companies only; public bodies, universities and hospitals appear in aggregate, and each can check its own domain with Stealercheck.
Does a stealer-log record mean a government system was breached?
No. The record was produced on an infected device, usually a personal computer on which an official saved a work password. It means the credential is in criminal hands, not that the body’s systems were compromised, although it is how many public-sector breaches begin.
Sources and further reading
- Government: infostealer statistics: the live sector page
- Infostealer statistics: the dataset, methodology and public API
- Infostealer exposure by country: all 36 countries ranked
- Confirmed ransomware attacks on government: the sector’s confirmed incidents since 2018
- Universities and infostealers: the sector at the opposite end of the table
- IRS Criminal Investigation: U.S. joins international action against RedLine and META infostealers, Operation Magnus, 29 October 2024
The Ransomnews Monthly
One email a month. Original leak-site data, victim census updates, and the findings that did not make the articles. No spam, unsubscribe any time.
Double opt-in. We store your email, signup time, and IP for consent records (GDPR Art. 7). See our privacy policy.