Report by SpyCloud
2026 Identity Exposure Report
Key Findings
Successful phishing attacks have surged 400% year-over-year.
Among the exposed corporate credentials analyzed, 80% contain plaintext passwords.
Passwords containing 'sweet', 'cookie', 'candy', 'cake', or 'pie' appear 5.7 million times in exposed credentials.
Enterprise workforces are three times more likely to be targeted with phishing attacks than with infostealer malware.
There is an average of 50 exposed user credentials per infostealer malware infection.
Passwords containing 'chiefs' or 'kansas city chiefs' appear 5 million times in exposed credentials.
The password '2025' appears 4.1 million times in exposed credentials.
Passwords containing 'apple', 'banana', 'orange', 'strawberry', or 'fruit' appear 2.6 million times in exposed credentials.
The password '67' or 'sixseven' appears 140.4 million times in exposed credentials.
SpyCloud identified 1.1 million password manager master passwords circulating in underground sources.