Summary Points
- SpyCloud’s 2026 Identity Exposure Report reveals a 23% increase in stolen identity data, totaling 65.7 billion records, with a significant rise in non-human identities like API keys and machine credentials, many lacking MFA and operating with broad permissions.
- Phishing remains a top enterprise threat, with 28.6 million compromised identities in 2025, nearly half of which are corporate users; attackers exploit session cookies, tokens, and MFA data for sophisticated session hijacking and MFA bypass via advanced techniques.
- Malware-based exfiltration also continues, with over 642 million credentials stolen from 13.2 million infections, often on devices with security tools, demonstrating endpoint controls alone are insufficient against identity theft.
- The report emphasizes the expanding attack surface due to cloud and AI adoption, urging organizations to implement continuous monitoring and automated remediation to mitigate the increasing risks posed by interconnected human and machine identity vulnerabilities.
Problem Explained
The 2026 SpyCloud Identity Exposure Report reveals a troubling rise in cybercriminal activities targeting both human and machine identities. Over the past year, there has been a 23% increase in stolen identity records, totaling 65.7 billion, with attackers shifting focus beyond traditional credentials to include exposed API keys, session tokens, and machine IDs. These non-human identities are particularly dangerous because they often lack multi-factor authentication (MFA) and have broad permissions, enabling persistent access to critical systems and cloud infrastructure. SpyCloud, a leader in cybersecurity, reports this data based on its extensive collection of stolen credentials, malware logs, and underground surveillance, highlighting how phishing attacks have surged by 400%, often now including session cookies and tokens that make bypassing security measures easier.
This increase in exposed identities allows cybercriminals to conduct faster, more scalable attacks, as evidenced by Europol’s recent dismantling of the Tycoon 2FA phishing infrastructure with SpyCloud’s assistance. Malware continues to be a major source of stolen credentials, with over 640 million exposed credentials recovered from infected devices in 2025. The report underscores that weak passwords, reuse, and insufficient endpoint defenses contribute to this growing threat landscape. Ultimately, as organizations adopt more cloud services and AI tools, the interconnectedness of machine identities widens the attack surface, demanding continuous monitoring and automated remediation. SpyCloud’s insights, derived from years of cybercrime disruption, serve as a warning and a guide for defenders to better protect both human and machine assets against this evolving threat.
What’s at Stake?
The issue highlighted in SpyCloud’s 2026 Identity Exposure Report — the surge in non-human identity theft — can severely impact your business by exposing sensitive data or enabling malicious automation. As criminals increasingly exploit bots and machine identities, they can bypass traditional security measures, compromise accounts, or launch fraud schemes. Consequently, your company’s reputation, customer trust, and financial stability are at risk. Moreover, this surge creates vulnerabilities that cybercriminals can manipulate for espionage or illicit gains, leading to hefty losses and legal liabilities. Therefore, staying ahead of such threats is essential to safeguard your operations and maintain confidence in your security posture.
Fix & Mitigation
In the face of rapidly escalating identity theft incidents, especially those involving non-human identities as highlighted in SpyCloud’s 2026 report, prompt and effective remediation is critically important to mitigate damage, restore trust, and prevent further exploitation. Swift action helps contain breaches and reduces potential financial, reputational, and operational impacts.
Mitigation Steps
-
Monitoring & Detection: Implement continuous monitoring for unusual activity related to non-human identities to identify breaches early.
-
Access Controls: Strengthen authentication protocols and enforce strict access controls to prevent unauthorized use of identities.
-
Data Encryption: Encrypt sensitive data associated with digital identities to protect against interception or theft.
Remediation Steps
-
Incident Response: Activate a comprehensive incident response plan to address identity exposure promptly.
-
Identity Revocation: Quickly revoke or deactivate compromised identities to prevent misuse.
-
User Notification: Inform affected stakeholders of the breach, providing guidance on remedial actions and future precautions.
-
Review & Update: Conduct thorough reviews of current security measures and update policies to address vulnerabilities identified during the incident.
Explore More Security Insights
Explore career growth and education via Careers & Learning, or dive into Compliance essentials.
Learn more about global cybersecurity standards through the NIST Cybersecurity Framework.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1cyberattack-v1-multisource
