Which countries have the most stolen employee logins? 36 ranked

The United States, Turkey and Saudi Arabia have the highest share of large organisations with employee logins in stealer logs: 98.6%, 97.9% and 97.5% of the institutions we measure there. By depth of exposure the order changes: the median US organisation has 609 stolen employee credentials in circulation, the median Indian one 208 and the median Brazilian one 170, while Estonia, Latvia and Lithuania sit at the bottom on both measures. This ranking covers 36 countries and 1,856 organisations from the October 2026 snapshot of the Ransomnews Infostealer Exposure Dataset, and every country below has a page of its own.

Which countries have the most organisations exposed to infostealers?

Thirty of the 36 countries have a hit rate above 80%, which is the headline: in almost every economy we measure, more than four in five large institutions have at least one employee whose work password was captured from an infected device. The spread is at the edges. Twelve countries are above 93% (the United States, Turkey, Saudi Arabia, South Africa, Spain, Brazil, France, Portugal, India, Israel, Switzerland and Poland), and only five are below 80%: Sweden (79.6%), Ukraine (78.6%), Lithuania (72.9%), Latvia (72.4%) and Estonia (67.7%), with Ireland exactly at 80.0%. The three Baltic states are least exposed on every measure, with medians of 2, 6 and 6.5, which fits small workforces, a local-language web that the big stealer families target less, and a decade of eID and app-based login in the public sector that leaves fewer passwords to steal.

#	Country	Orgs	Exposed	Median	New, 30 days	Gained new	Top sector
1	United States	138	98.6%	608.5	4,241	77.5%	Technology
2	Turkey	47	97.9%	71	549	74.5%	Universities
3	Saudi Arabia	40	97.5%	50.5	673	65.0%	Universities
4	South Africa	60	96.7%	63	847	63.3%	Universities
5	Spain	46	95.7%	73.5	1,220	67.4%	Universities
6	Brazil	61	95.1%	170	965	77.0%	Universities
7	France	55	94.5%	63	899	72.7%	Universities
8	Portugal	35	94.3%	35	265	40.0%	Universities
9	India	69	94.2%	208	3,626	78.3%	Technology
10	Israel	48	93.8%	20	207	45.8%	Banking and finance
11	Switzerland	46	93.5%	23	229	50.0%	Universities
12	Poland	44	93.2%	28.5	198	40.9%	Universities
13	Mexico	55	92.7%	65	1,661	60.0%	Universities
14	Germany	55	92.7%	40	666	67.3%	Universities
15	Canada	71	91.5%	62	1,333	70.4%	Universities
16	Italy	46	91.3%	43	1,622	65.2%	Universities
17	Australia	68	91.2%	23	1,043	50.0%	Universities
18	Austria	43	90.7%	16	68	25.6%	Universities
19	Belgium	42	90.5%	27	251	50.0%	Universities
20	United Kingdom	73	90.4%	55	938	63.0%	Universities
21	South Korea	52	88.5%	26.5	351	48.1%	Universities
22	Nigeria	49	87.8%	36	508	57.1%	Universities
23	Netherlands	46	87.0%	42.5	641	63.0%	Universities
24	Finland	45	86.7%	18	217	42.2%	Universities
25	Norway	40	85.0%	18.5	81	32.5%	Universities
26	United Arab Emirates	46	84.8%	28	281	47.8%	Universities
27	Denmark	46	84.8%	14.5	266	43.5%	Universities
28	Singapore	46	82.6%	15.5	184	26.1%	Universities
29	Japan	67	82.1%	14	180	34.3%	Media
30	Czechia	38	81.6%	14.5	54	36.8%	Universities
31	Ireland	40	80.0%	13.5	74	32.5%	Universities
32	Sweden	49	79.6%	23	397	53.1%	Retail
33	Ukraine	42	78.6%	10.5	10	11.9%	Universities
34	Lithuania	48	72.9%	6.5	52	25.0%	Universities
35	Latvia	29	72.4%	6	17	17.2%	Universities
36	Estonia	31	67.7%	2	12	16.1%	Banking and finance

Why do the United States, India and Brazil lead by volume?

Headcount first. The US panel is drawn from the largest employers on earth, so the same infection rate per employee produces a far larger count of exposed credentials: the median US company carries 623 against 26 for the median company in the other 35 countries, more than twenty times as many. India and Brazil combine very large workforces with the second effect, which is supply. The stealer families that dominate the index, LummaC2, RedLine, Vidar and StealC, are distributed through cracked software, game cheats and malvertising, and the Telegram markets that trade their output have always harvested more from the Americas and South Asia than from Northern Europe. The index reflects where the infected machines are.

The sector mix adds a third layer. The most exposed sector in the United States and India is technology (medians of 1,062 and 1,594 respectively), where large IT-services and outsourcing workforces save work logins on personal hardware; in Brazil, Spain, Italy and most of the panel it is universities, where students share the institutional email domain. The 30-day figures confirm that these three are not carrying old stock: 78.3% of Indian, 77.5% of US and 77.0% of Brazilian organisations gained at least one new employee credential in the month to 13 October, the three highest rates in the panel.

Where is exposure growing fastest right now?

India, Italy, the United States and Mexico. The lifetime totals say where logs have piled up over years; the 30-day column says where the infections are happening now, and the two rankings differ. Measured as new employee credentials per organisation in the month to 13 October, India leads at 53 per organisation, followed by Italy (35), the United States (31), Mexico (30) and Spain (27); Italy and Mexico barely feature in the lifetime ranking, which is the point. In absolute terms the United States added 4,241 employee credentials in the month and India 3,626, between them a third of the panel’s entire monthly flow, and the share of organisations gaining at least one was highest in India (78.3%), the United States (77.5%), Brazil (77.0%), Turkey (74.5%) and France (72.7%).

At the quiet end the month added ten employee credentials across the whole Ukrainian panel, twelve in Estonia and 17 in Latvia, and fewer than one in five organisations there gained one. Japan is the large-economy outlier in the other direction: 82.1% of Japanese organisations are exposed but the median is 14 and only 34.3% gained a credential in the month, consistent with managed corporate devices and a workforce that rarely mixes personal and work logins in one browser profile. These are the countries to watch for the opposite reason: a sudden rise in their 30-day column would be a campaign, not noise.

Which sector is most exposed in each country?

Universities are the most exposed sector in 30 of the 36 countries, with a 100% hit rate in all but Lithuania, because students use the institutional domain on personal laptops. The exceptions are instructive: technology companies lead in the United States and India, banks lead in Israel and Estonia, media organisations in Japan and retailers in Sweden. At the other end, government and law-enforcement bodies are the least exposed sector in 24 countries, a pattern explored in our report on government bodies in stealer logs, and the universities page carries the full country breakdown for higher education.

What do the stolen logins open, country by country?

The third-party service most often captured alongside a work email login is Salesforce in the United States (8,343 logins across 47 organisations), India (2,579), France, the Netherlands and Switzerland; Autodesk, which is student software, in Brazil, Spain, Italy, Mexico (4,705 logins), Portugal, Poland, Saudi Arabia, South Africa, Belgium, Denmark, Czechia, Ireland, Nigeria and Sweden; Zoom in Israel, South Korea, Turkey, Singapore, Canada and Norway; and Okta, the identity provider whose login opens everything behind single sign-on, in Australia (1,934 logins across 11 organisations), the United Arab Emirates, the United Kingdom, Finland, Japan and Estonia. Germany is the only country where an ERP system leads, with 304 SAP S/4HANA Cloud logins across six organisations. Our companion piece on what stolen SaaS logins open works through the whole stack.

What is on each country page?

Each of the 36 country pages carries the same material, recomputed from the stored snapshot every month: the hit rate, median and 30-day figures for that country against the panel as a whole; the country’s rank by share exposed and by credentials per organisation; a sector table for the national panel; the companies measured, by employee credentials, with the caveat that these are logins captured from infected devices rather than evidence that the company’s own systems were breached; the third-party services most often captured alongside work logins in that country; and a short FAQ. Government, university and hospital figures appear only in aggregate. The United States, United Kingdom and Germany pages are the fullest, because those panels are largest.

What this means

A country hit rate above 90% is a statement about personal devices, not national cyber-defence. The records behind these figures are produced when an employee saves a work password in a browser on a machine that later runs a cracked installer, and no national agency can manage that machine. The useful comparison is month on month: from the November snapshot every country page will show whether its hit rate, median and 30-day exposure moved, and the countries whose employee exposure rises are the ones we expect to see rising in the confirmed ransomware attack statistics a quarter later, because stolen logins are what initial access brokers sell.

Frequently asked questions

Sources and further reading

• Infostealer statistics: the dataset page, with the live tables, the methodology and the public API
• Universities and government: the two sectors that bracket every national ranking
• Stealercheck: check any domain against the same index
• Top infostealer families in 2026: the malware behind the records
• Confirmed ransomware attacks by sector, country and year: the other end of the credential pipeline
• IRS Criminal Investigation: U.S. joins international action against RedLine and META infostealers, Operation Magnus, 29 October 2024
• BleepingComputer: Lumma infostealer malware operation disrupted, 2,300 domains seized, 21 May 2025