A stolen employee login is rarely just the email password. In the October 2026 snapshot of the Ransomnews Infostealer Exposure Dataset, the stealer logs for 707 large companies also hold 13,380 Salesforce logins, 4,438 Okta logins, 2,928 GitHub logins and 942 Amazon Web Services logins registered with company email addresses, plus the consoles of the security tools meant to stop the theft. This is what an attacker actually gets with a captured identity, company by company and sector by sector.
Which SaaS logins are stolen most often?
Salesforce, by a distance, then the identity layer. Across the 707 companies in the panel with such records (government, university and health bodies are excluded here), Salesforce CRM logins lead with 13,380 across 199 companies, followed by Okta (4,438 across 108), Cisco cloud services (3,570 across 125), Adobe Experience Cloud (3,013 across 199), GitHub (2,928 across 106), Webex (2,185), Discord (2,114), Zoom (1,826), Box (1,361), Dropbox Business (1,283), SAP S/4HANA Cloud (1,278 across 68), Amazon Web Services (942 across 74), Slack (835), Zendesk (688) and Red Hat (666). The reason a stealer log holds all of this is mechanical: the malware takes every password saved in the browser, so the same log that holds the corporate email login holds the logins to whatever the employee used that browser for.
| Service | Captured logins | Companies | What it opens |
|---|---|---|---|
| Salesforce CRM | 13,380 | 199 | Customer records, pipeline, contracts |
| Okta | 4,438 | 108 | Every application behind single sign-on |
| Cisco cloud services | 3,570 | 125 | Network and security management |
| Adobe Experience Cloud | 3,013 | 199 | Marketing, web content, customer data |
| GitHub | 2,928 | 106 | Source code, secrets, CI pipelines |
| Webex | 2,185 | 155 | Meetings and messaging |
| Discord | 2,114 | 88 | Community and team chat |
| Zoom | 1,826 | 162 | Meetings and recordings |
| Box | 1,361 | 93 | Document storage |
| Dropbox Business | 1,283 | 118 | Document storage |
| SAP S/4HANA Cloud | 1,278 | 68 | ERP: finance, HR, supply chain |
| Amazon Web Services | 942 | 74 | Cloud infrastructure and data |
| Slack | 835 | 113 | Internal messaging and files |
| Zendesk | 688 | 101 | Customer support tickets |
| Red Hat | 666 | 55 | Enterprise Linux and middleware |
Identity providers and password managers: the keys to everything
The single most dangerous record in this dataset is an identity-provider login. Okta accounts for 4,438 of the 4,897 identity logins captured for companies, across 108 of them, and the stealer usually captures the Okta session cookie next to the password, which is why cookie replay rather than password reuse is the common first step. By sector the Okta logins concentrate in technology companies (2,196 across 35), consumer-goods companies (1,034 across five), logistics (297), healthcare (269), banking (265) and pharmaceuticals (222). Across the whole panel, including universities and public bodies, the Okta total rises to 6,726 across 132 organisations.
Password managers are the other master key, and they appear too: 183 1Password Business logins across seven companies, 82 LastPass Business across 26, 37 Bitwarden Business across 11, 11 Dashlane Business across ten, plus 63 CyberArk and 18 Ping Identity logins. A password-manager master password in a stealer log is worse than any single application login, because it unlocks every other credential the employee holds. Microsoft Entra and Google Workspace do not appear in this table, most likely because the index attributes those logins to the organisation’s own domain rather than to a third-party service.
Developer tools and cloud consoles
GitHub dominates the developer layer with 2,928 captured logins across 106 companies, against 58 GitLab, 44 Bitbucket, 149 JetBrains and 30 Docker logins, and 398 Trello logins across 78 companies. In the cloud layer Amazon Web Services leads with 942 logins across 74 companies; Cloudflare (48), Heroku (24) and the others are marginal in this index, which suggests that AWS console passwords are saved in browsers far more often than their rivals’ or that the index catalogues them better. A GitHub login is rarely the end of the chain: repositories hold API keys, deployment credentials and the CI secrets that turn a developer identity into production access, which is the sequence behind a large share of the supply-chain incidents of the last two years.
Security tools in stealer logs
The consoles of the defences themselves are in the logs. Cisco cloud services, which include network and security management, lead with 3,570 logins across 125 companies; Fortinet FortiGate Cloud follows with 423 across 41 companies, Mimecast with 506 across 13 (plus 252 Mimecast Awareness Training logins, which is its own small irony), Symantec with 115, Palo Alto Networks with 102 across 14, Datadog with 63, Splunk with 57, Trend Micro Cloud One with 53, Tenable with 34, CrowdStrike with 27 across nine, and Sophos and Bitdefender with 20 each. Remote-access tools are there as well: 348 TeamViewer logins across 53 companies, 52 Citrix DaaS, 30 AnyDesk. A firewall-management or remote-access login captured from an administrator’s home machine is initial access without any exploit at all.
AI accounts
OpenAI logins registered with company email addresses number 593 across 89 companies in this snapshot, 3,891 across 316 organisations when universities and public bodies are included, and 439 across 20 government bodies on their own. The risk is not the subscription. It is the conversation history, which for a working employee is a searchable archive of drafts, code, contracts and internal problems, and the API keys that sit in the same account. Replit, Hugging Face, Cursor and Tabnine appear in small numbers, which will grow.
Free tool
How does your own site score?
Run the same forty passive checks against your own domain: TLS and certificates, security headers, SPF and DMARC, cookies before consent, and what your stack quietly reveals. A grade out of 100 in about fifteen seconds.
No signup. Nothing installed. We only request what your site already serves publicly.
How does the mix differ by sector?
| Sector | Largest category of captured third-party logins | Second | Third |
|---|---|---|---|
| Banking and finance | CRM, 49.6% | Identity and access management, 6.5% | Video conferencing, 6.1% |
| Hospitals and health systems | CRM, 35.7% | Identity and access management, 12.3% | Video conferencing, 12.1% |
| Technology | CRM, 27.3% | Source control and DevOps, 8.3% | Networking and security, 7.1% |
| Telecoms | Networking and security, 11.0% | Video conferencing, 9.8% | CRM, 9.8% |
| Industrial | CRM, 17.6% | Cloud storage, 11.0% | Marketing and creative, 7.4% |
| Retail | Video conferencing, 13.9% | CRM, 7.8% | Marketing and creative, 7.1% |
| Government | Video conferencing, 28.8% | Team chat, 22.3% | Marketing and creative, 9.8% |
| Universities | Construction and design, 25.3% | Video conferencing, 14.8% | Marketing and creative, 6.7% |
In banking half of everything captured alongside a work email is a CRM login, almost all of it Salesforce, which is where the customer book lives. In hospitals CRM and identity providers together are nearly half. In technology companies the developer and security layers appear behind CRM, and in government the stolen logins are overwhelmingly meeting and chat tools, which says more about what public servants use personal devices for than about what the state runs.
What should companies do with this?
Start with the identity layer. Any identity-provider or password-manager login that appears in a stealer log is an incident: reset it, revoke every active session so the stolen cookie dies, re-enrol MFA on phishing-resistant methods, and find the infected device. Then shorten session lifetimes on single sign-on and bind sessions to managed devices where the provider supports it, because a stolen cookie that cannot be replayed from another machine is worth nothing. Rotate GitHub personal access tokens and AWS keys for any developer whose login appears, and block browser password saving for work accounts in favour of a managed password manager. Check your own domain with Stealercheck, which returns the lifetime, 30-day and 7-day counts for free; the controls that stop the infection in the first place are in our guide to ransomware protection for business.
Frequently asked questions
What do attackers get from a stolen employee login?
Everything saved in the same browser. In the October 2026 snapshot the stealer logs for 707 large companies also held 13,380 Salesforce logins, 4,438 Okta logins, 2,928 GitHub logins, 942 AWS logins and the consoles of security products such as Fortinet, Palo Alto Networks and CrowdStrike.
Why is an Okta login in a stealer log so dangerous?
Because it is the key to every application behind the company’s single sign-on, and the stealer usually captures the session cookie next to the password, which lets an attacker resume the session without the password or the MFA prompt.
Which sector has the most exposed CRM logins?
Banking and finance, where 49.6% of all third-party logins captured alongside a work email are CRM logins, almost entirely Salesforce. In hospitals the figure is 35.7% and in technology companies 27.3%.
Are security products themselves in stealer logs?
Yes. The October 2026 snapshot holds 3,570 Cisco cloud logins, 423 Fortinet FortiGate Cloud logins, 506 Mimecast logins, 102 Palo Alto Networks logins and 27 CrowdStrike logins registered with company email addresses, plus 348 TeamViewer and 30 AnyDesk remote-access logins.
Does a stolen SaaS login mean the SaaS provider was breached?
No. The credentials were captured on infected employee devices, not from the provider. Salesforce, Okta and GitHub appear at the top of the table because they are the services most employees save passwords for, not because of any weakness in those products.
How were these numbers produced?
From the Ransomnews Infostealer Exposure Dataset: a monthly query of the Alerts.bar stealer-log index for a fixed panel of 1,874 organisation domains in 36 countries, summing the third-party services recorded alongside each domain’s accounts. Only aggregate counts are stored.
Sources and further reading
- Infostealer statistics: the dataset, with service categories for every country and sector
- Technology companies, banking and finance and healthcare: sector pages with the full service tables
- MFA bypass via cookie theft: why the session cookie is the record that matters
- What is inside an infostealer log: the file an attacker actually buys
- Initial access brokers: who buys these logins and what they do with them
- Microsoft: Disrupting Lumma Stealer, 394,000 infected Windows machines identified between 16 March and 16 May 2025
The Ransomnews Monthly
One email a month. Original leak-site data, victim census updates, and the findings that did not make the articles. No spam, unsubscribe any time.
Double opt-in. We store your email, signup time, and IP for consent records (GDPR Art. 7). See our privacy policy.