Infostealers in the United States: 98.6% of 138 large organisations have staff logins in stealer logs

Infostealer statistics · United States · October 2026

98.6% of the 138 large US organisations in the Ransomnews panel have employee credentials in stealer logs in the October 2026 snapshot, against 89.4% across all 36 countries. The median organisation in the United States has 608.5 such credentials in circulation (31 panel-wide), 4,241 were captured in the 30 days before the snapshot, and 77.5% of organisations gained at least one. The United States ranks 1st of 36 countries by the share of organisations exposed and 1st by credentials per organisation.

By the Ransomnews Research Team. Part of the Ransomnews Infostealer Exposure Dataset; aggregates only, refreshed monthly.

How large US organisations compare with the rest of the panel

Large US organisations are more exposed than the panel as a whole: 98.6% of them have at least one employee credential captured by infostealer malware, against 89.4% across the panel, and the median organisation carries 608.5 credentials against 31. The distribution is long-tailed: 2 organisations have no employee credentials in the index, 104 have a hundred or more and 30 have a thousand or more. 83 organisations gained new credentials in the final seven days before the snapshot.

Lifetime totals accumulate over years of captures; the 30-day and 7-day figures are the measure of current activity. A stealer-log record is produced on an infected device, usually a personal or unmanaged machine where an employee saved work passwords in the browser; it means that credential is in criminal hands, not that the organisation’s own systems were breached.

Which sectors in the United States are most exposed?

The most exposed sector in the United States is Technology, with 100.0% of 20 organisations exposed and a median of 1,061.5 employee credentials; the least exposed is Defence and aerospace, at 80.0% of 5 and a median of 17. Sectors with only a handful of organisations in the national panel are listed but should be read with care.

Hit rate: share of organisations with at least one employee credential in stealer logs. Consumer mailbox hosts are excluded from employee figures. Source: Ransomnews Infostealer Exposure Dataset, October 2026.

Which US companies have the most employee logins in stealer logs?

google.com (4,288), amazon.com (4,160) and ibm.com (3,054) carry the most employee credentials in the index among the companies measured in the United States. Per-organisation figures are published for companies only; government, university and health bodies in the panel are reported in the aggregates above. The counts are logins captured from infected devices on which staff had saved their work passwords, not evidence that the company’s own systems were breached; a company with a large workforce and many contractors accumulates more of them for the same infection rate.

Companies in the panel in the United States, up to 40, by employee credentials in stealer logs. * hosts consumer mailboxes, so employee figures are withheld. Customer logins are credentials captured on the company's own login pages. Source: Ransomnews Infostealer Exposure Dataset, October 2026.

What do the stolen employee logins open?

A stealer takes every password saved on the infected machine, so the log that holds an employee’s email login usually holds their logins to the organisation’s cloud services too. Across the 114 organisations in the United States with such records, the services most often captured alongside a work email address are Salesforce CRM, Adobe Experience Cloud and GitHub (Microsoft). By category, CRM (25.5%), Marketing & Creative (7.6%) and Team Chat (7.6%) lead.

Service counts are summed from each organisation’s 25 largest services; categories are the index’s own labels, lightly consolidated. An identity-provider login (Okta, Entra, Ping) is the most dangerous record in this table: it opens every application behind the organisation’s single sign-on, and the stealer usually captures the session cookie next to it.

How to use these figures

Check your own domain with Stealercheck, which returns the same lifetime, 30-day and 7-day counts, and compare the result with the median above (608.5 for large US organisations). For every exposed account: reset the password, revoke active sessions so stolen cookies stop working, re-enrol MFA and find the infected device. Then block browser password saving for work accounts in favour of a managed password manager and shorten session lifetimes on single sign-on. The controls that stop the infection itself are in our guide to ransomware protection for business.

Frequently asked questions

More infostealer statistics

• Infostealer statistics: families, countries and sectors
• Stealercheck: check any domain against the same index
• Ransomware statistics: confirmed attacks by month

By country

• Australia91.2%
• Austria90.7%
• Belgium90.5%
• Brazil95.1%
• Canada91.5%
• Czechia81.6%
• Denmark84.8%
• Estonia67.7%
• Finland86.7%
• France94.5%
• Germany92.7%
• India94.2%
• Ireland80.0%
• Israel93.8%
• Italy91.3%
• Japan82.1%
• Latvia72.4%
• Lithuania72.9%
• Mexico92.7%
• Netherlands87.0%
• Nigeria87.8%
• Norway85.0%
• Poland93.2%
• Portugal94.3%
• Saudi Arabia97.5%
• Singapore82.6%
• South Africa96.7%
• South Korea88.5%
• Spain95.7%
• Sweden79.6%
• Switzerland93.5%
• Turkey97.9%
• Ukraine78.6%
• United Arab Emirates84.8%
• United Kingdom90.4%
• United States98.6%

By sector

• Airlines and transport95.6%
• Automotive82.1%
• Banking and finance88.7%
• Consumer goods81.7%
• Defence and aerospace89.5%
• E-commerce96.2%
• Gaming94.1%
• Government76.3%
• Healthcare95.8%
• Industrial87.1%
• Insurance85.4%
• Logistics and post91.2%
• Media97.8%
• Mining93.3%
• Oil, gas and energy92.5%
• Pharmaceuticals94.3%
• Retail78.0%
• Technology94.1%
• Telecoms89.4%
• Universities99.3%
• Utilities94.7%

Method. Figures come from the October 2026 snapshot of the Alerts.bar infostealer index, taken for a fixed panel of 1,874 organisation domains in 36 countries and stored by Ransomnews; the panel is held constant so that month-on-month change reflects the threat rather than the sample. Employee credentials are stealer-log records whose username is an address on the organisation’s domain (university figures include students); customer logins are credentials captured on the organisation’s own login pages; session cookies are authentication cookies harvested from infected browsers. The index reports a floor of 1 on lifetime counters, which we record as 0, and domains that host consumer mailboxes are excluded from employee figures. Full methodology and the public API: infostealer statistics. Cite as: Ransomnews Infostealer Exposure Dataset, ransomnews.com.