Infostealer statistics 2026: stealer-log exposure by family, country and sector

This page tracks the infostealer economy with numbers, refreshed monthly: which malware families produce the stolen logins in circulation, how many stolen employee credentials and session cookies exist for a fixed panel of 1,874 large organisations in 36 countries, which countries and sectors are most exposed, and which business services the stolen logins belong to. The source is the Alerts.bar stealer-log index, which is operated by the same group as Ransomnews. Every figure below is an aggregate; no credential or personal record is stored or shown.

By the Ransomnews Research Team. Snapshot: October 2026, collected 13 October 2026. The tables recalculate from the latest snapshot on each load. Cite as: Ransomnews Infostealer Exposure Dataset, with a link to this page.

Key infostealer figures this month

Two figures matter more than the rest. The share of organisations with at least one employee credential in stealer logs is the cleanest measure of corporate exposure, because an employee login captured from an infected laptop is what initial-access brokers sell and what ransomware crews buy. The 30-day figure shows the pace at which that exposure is renewing, which the headline totals, accumulated over years, hide.

Which infostealer families dominate?

LummaC2, RedLine and Vidar between them account for roughly four in five stealer-log records in the index, with StealC the only other family above 10%. The share is measured by records, so it reflects which malware captured the credentials in circulation rather than how many machines each family infected. RedLine’s share is a legacy of its years at the top before the 2024 takedown; LummaC2 is the family that replaced it and is still growing.

Infostealer families by share of records, October 2026

Family	Records	Share	Change
LummaC2	5,326,795	31.7%
RedLine	4,080,501	24.3%
Vidar	3,905,085	23.2%
StealC	1,806,479	10.8%
Acreed	813,344	4.8%
MacSync/SHub Stealer	449,606	2.7%
Others (unattributed)	350,581	2.1%
DarkCrystalRat	38,043	0.2%
Mystic	29,252	0.2%

Which countries are most exposed to infostealers?

For each country the panel holds its largest listed companies, main banks and telecoms, central government bodies, leading universities, major hospitals or health systems, and national media, between 30 and 140 organisations depending on the size of the economy. The hit rate is the share of those organisations with at least one employee credential captured by infostealer malware; the median shows what a typical organisation in that country looks like, so that one heavily exposed bank cannot drag a whole country up the table. Panels are not random samples, so read the ranking as a comparison of national institutions, not of populations.

Exposure by country, October 2026

Country	Organisations	Hit rate	Median per org	Employee credentials	Session cookies	Employee creds, 30 days
United States	139	98.6%	609	96,944	948,827,308	4,241
Turkey	47	97.9%	71	8,943	5,219,905	549
Saudi Arabia	40	97.5%	51	8,524	1,021,595	673
South Africa	60	96.7%	63	6,127	670,878	847
Spain	46	95.7%	74	14,373	8,590,526	1,220
Brazil	64	95.1%	170	17,932	15,848,598	965
France	55	94.5%	63	13,610	5,941,503	899
Portugal	36	94.3%	35	3,906	791,209	265
India	69	94.2%	208	39,630	10,997,439	3,626
Israel	48	93.8%	20	3,277	7,675,801	207
Switzerland	47	93.5%	23	2,503	1,467,260	229
Poland	46	93.2%	29	2,117	12,462,498	198
Germany	56	92.7%	40	8,177	3,221,125	666
Mexico	55	92.7%	65	15,286	4,131,872	1,661
Canada	72	91.5%	62	14,833	4,336,104	1,333
Italy	46	91.3%	43	7,925	1,594,976	1,622
Australia	68	91.2%	23	4,452	45,509,090	1,043
Austria	44	90.7%	16	1,415	418,826	68
Belgium	43	90.5%	27	3,414	386,415	251
United Kingdom	75	90.4%	55	15,311	3,521,131	938
South Korea	53	88.5%	27	7,104	15,703,149	351
Nigeria	49	87.8%	36	5,169	332,504	508
Netherlands	46	87.0%	43	6,328	8,631,531	641
Finland	45	86.7%	18	3,469	830,041	217
Norway	40	85.0%	19	1,509	319,071	81
United Arab Emirates	46	84.8%	28	6,316	1,630,783	281
Denmark	46	84.8%	15	1,798	1,195,398	266
Singapore	46	82.6%	16	1,446	3,181,940	184
Japan	67	82.1%	14	2,027	1,120,184	180
Czechia	39	81.6%	15	1,303	1,897,928	54
Ireland	40	80.0%	14	1,408	495,430	74
Sweden	50	79.6%	23	5,219	19,567,194	397
Ukraine	42	78.6%	11	544	9,787,978	10
Lithuania	48	72.9%	7	937	4,287,930	52
Latvia	30	72.4%	6	349	144,113	17
Estonia	31	67.7%	2	641	1,779,198	12

Each country has its own page with the sector breakdown, the companies measured and the services the stolen logins open: see the index of country and sector pages below.

Which sectors are most exposed?

The same organisations grouped by sector across all 36 countries. Government, university and healthcare bodies are measured but reported only in aggregate; per-organisation figures are published for companies only.

Exposure by sector, October 2026

Sector	Organisations	Hit rate	Median per org	Employee credentials	Session cookies	Employee creds, 30 days
Crypto	1	100.0%	30	30	528,641	2
Universities	295	99.3%	127	91,092	2,247,853	11,989
Media	141	97.8%	16	9,016	93,252,180	428
E-commerce	26	96.2%	46	7,651	31,888,910	417
Healthcare	48	95.8%	45	12,325	2,119,465	339
Airlines and transport	90	95.6%	27	8,570	7,032,972	428
Utilities	57	94.7%	37	6,803	469,018	343
Pharmaceuticals	35	94.3%	187	9,121	106,261	260
Gaming	17	94.1%	43	1,611	58,741,574	105
Technology	105	94.1%	58	55,664	883,380,057	3,944
Mining	15	93.3%	57	2,213	32,434	107
Oil, gas and energy	40	92.5%	50	7,321	157,289	356
Logistics and post	34	91.2%	29	7,579	3,512,758	352
Defence and aerospace	19	89.5%	19	2,237	135,950	42
Telecoms	102	89.4%	31	24,510	4,752,910	1,053
Banking and finance	213	88.7%	27	21,605	36,890,899	952
Real estate	8	87.5%	11	174	41,189	8
Industrial	93	87.1%	38	10,562	1,141,647	596
Hospitality	7	85.7%	273	3,291	3,347,942	104
Insurance	41	85.4%	26	4,065	381,319	87
Automotive	39	82.1%	29	7,684	1,042,147	415
Consumer goods	60	81.7%	47	10,263	5,367,733	436
Retail	100	78.0%	18	13,105	11,970,728	614
Government	279	76.3%	12	16,714	4,979,509	1,427
Agriculture and food	9	55.6%	11	1,060	17,046	22

Which consumer brands have the most stolen logins?

Consumer brands are measured differently: the first column counts logins to the brand’s own site captured on infected consumer machines, which is a measure of how often that service appears in a victim’s saved passwords, not of any breach at the brand. Employee logins and session cookies are the columns that bear on the company itself. Combolist and breach-dump records are shown separately because they are older, duplicated and lower quality than stealer-log captures.

Consumer brands: stolen logins by service, October 2026

Brand	User logins (stealer)	Employee logins (stealer)	Session cookies	Heap records	New user logins, 30 days
google.com	22,202,180	4,288	388,213,465	275,749,146	936,543
facebook.com	13,309,050	n/a	38,585,049	266,526,179	495,520
roblox.com	11,227,551	268	20,517,603	164,774,732	349,085
discord.com	6,063,067	124	11,774,679	58,377,169	215,277
instagram.com	6,020,057	89	33,027,177	83,455,657	265,753
netflix.com	3,758,268	2,353	14,853,402	57,713,875	142,051
amazon.com	3,517,121	4,160	18,700,883	56,765,596	149,117
steampowered.com	2,923,524	43	16,606,440	35,506,586	112,806
twitch.tv	2,739,746	17	21,754,061	50,436,759	84,237
paypal.com	2,697,453	411	26,458,253	50,991,435	111,299
apple.com	2,381,085	1,105	3,627,415	31,545,934	115,706
epicgames.com	2,308,946	119	15,495,355	41,066,698	76,156
spotify.com	2,048,565	705	16,838,509	27,578,868	74,309
linkedin.com	1,598,938	270	77,139,458	25,526,620	72,554
github.com	1,213,379	93	1,777,878	10,505,647	55,833
ubisoft.com	944,083	456	2,465,847	11,003,009	36,044
ea.com	928,575	320	2,531,419	10,194,300	33,974
adobe.com	899,127	1,199	45,826,710	10,868,867	40,202
dropbox.com	607,336	60	6,828,011	12,273,926	24,723
coinbase.com	283,767	30	528,641	7,308,937	10,873
microsoft.com	236,451	3,037	138,141,088	2,393,686	9,316

Which business services do the stolen employee logins open?

When an employee’s machine is infected, the stealer takes every saved login, so the same log that holds the corporate email password usually holds the logins to the company’s chat, code hosting, cloud console and CRM. This table sums those third-party services, by category, across every organisation in the panel. It is the best public answer to the question of what an attacker actually gets with a stolen employee identity.

Which business services the stolen employee logins belong to, October 2026

Service category	Records	Organisations affected	Share
Construction & Design	19,864	377	14.0%
Video Conferencing	17,460	579	12.3%
CRM	14,436	235	10.2%
Marketing & Creative	8,760	449	6.2%
Team Chat	7,551	401	5.3%
Cloud Storage	6,763	427	4.8%
Identity & Access Management	6,696	127	4.7%
Source Control & DevOps	5,665	304	4.0%
Networking & Security	5,561	219	3.9%
AI Models & APIs	3,871	309	2.7%
Design	3,849	294	2.7%
Whiteboarding	3,043	321	2.1%
Learning Management	2,808	191	2.0%
Talent Cloud	2,547	91	1.8%
Cloud Infrastructure	2,022	177	1.4%
Project Management	1,974	281	1.4%
ERP	1,712	124	1.2%
Developer Tools & IDE	1,608	197	1.1%
Productivity & Notes	1,524	172	1.1%
Experience Management	1,387	117	1.0%

Infostealer statistics by country and sector

One page per country and per sector, each composed from the latest snapshot: hit rate, median exposure, the breakdown by sector or country, the companies measured (companies only; public bodies, universities and hospitals stay aggregate) and the third-party services the stolen employee logins open. The figures next to each name are the share of organisations with employee credentials in stealer logs and the median per organisation.

Methodology

Source. All figures come from the Alerts.bar infostealer index, a continuously updated collection of stealer logs, session cookies and breach data that powers the free Stealercheck lookup on this site. Alerts.bar and Ransomnews are operated by the same group; we state that here and in every report built on this data. The index is queried through the same API the lookup tool uses, and the counts here are the same counts anyone can obtain by checking a domain there.

What is counted. A stealer-log credential is a username and password captured by infostealer malware on an infected device. Employee credentials are those where the username is an email address at the organisation’s domain; user logins are credentials captured on the organisation’s own login pages, mostly customers. Session cookies are authentication cookies harvested from infected browsers, which let an attacker resume a logged-in session without a password or MFA prompt. Heap records are entries from combolists, paste-site dumps and breach compilations, counted separately because they are older and heavily duplicated. Breach sets is the number of distinct public breach datasets in which the domain appears. The 30-day columns count records first indexed in the 30 days before the snapshot.

Panel. A fixed list of 1,874 organisation domains across 36 countries, chosen in October 2026 from each country’s largest listed companies, principal banks, telecoms and utilities, central government and law-enforcement bodies, leading universities, major hospital systems and national media, plus a 21-brand consumer panel that matches the Ransomtracker landscape dashboard. The panel is held constant between snapshots so that month-on-month changes reflect the threat and not the sample. Per-organisation figures are published for companies only; government, university and healthcare bodies appear in aggregates. Domains are matched at the registrable-domain level: folha.uol.com.br counts towards uol.com.br, but public suffixes are their own domains, so hmrc.gov.uk is counted separately from gov.uk and the national suffix domains in the government panel capture only addresses on the bare domain. Eighteen panel domains that host consumer mailboxes (wp.pl, naver.com, seznam.cz, sky.com and similar) are kept for cookie and user-login figures but excluded from every employee-credential figure, because an address on those domains belongs to a customer, not a member of staff. University figures include students, who use the same email domain as staff.

Cadence. A snapshot is taken in the first days of every month and stored; each snapshot is a point-in-time copy of the index, and the month-on-month deltas on this page are computed between stored snapshots rather than reconstructed. The first snapshot is October 2026, so trend columns fill in from November 2026. Quarterly sector studies and the annual State of Stealer Logs report are compiled from the same snapshots.

Limitations. The panel is a curated set of large institutions, not a random sample of all organisations, and panel sizes differ by country. Counts measure exposure present in one index, not infections, and the absence of a record is not evidence that an organisation is unaffected. Records accumulate over years, so the totals include old captures; the 30-day columns are the better measure of current activity. Attribution to a malware family is the index’s own classification of each log. The index reports a floor of 1 on every lifetime counter, so a lifetime value of exactly 1 cannot be told apart from none; we record it as 0, which makes the hit rates on this page conservative. Lifetime totals and the 30-day columns come from different parts of the index and are not always consistent with each other for very small domains.

How to use these numbers

Security teams can check their own domain with Stealercheck and compare the result against the median for their country and sector above. A result far above the median usually means infected personal devices with corporate logins saved in the browser, which is the gap the numbers on this page describe and the one our guide to how stealer logs power ransomware attacks explains. Journalists and researchers can cite any figure on this page as the Ransomnews Infostealer Exposure Dataset, with a link; the public API behind the tables is documented at /wp-json/rn-research/v1/summary, and bulk extracts are available on request at [email protected].

Reports built on this dataset

• Monthly: the Infostealer report, published in the first week of each month from the new snapshot.
• Quarterly: sector studies on the panel, starting with the largest listed companies and rotating through government, healthcare, universities and banking.
• Annual: State of Stealer Logs, compiled from the twelve monthly snapshots with a downloadable dataset.

Frequently asked questions

Related: confirmed ransomware attack statistics, the Ransomtracker leak-site index, and our field guide to what stealer logs are.