Cybercheck Surpasses 400 Billion Recovered Compromised Credentials
At the turn of this month, Cybercheck achieved a daunting data milestone, having recovered more than 400 billion records containing compromised credentials from criminal sources.
The figure highlights the extraordinary rate at which stolen personal and corporate data is circulating across the cybercriminal ecosystem. As recently as December 2025, during Black Hat Europe, Cybercheck announced it had reached 300 billion records. Just nine months later, that total surpassed 400 billion.
As Cybercheck’s analysts and engineers continue to identify, infiltrate, and monitor criminal communities, one trend has become difficult to ignore: the rapid growth in stolen credentials available to cybercriminals.
So, what is driving this surge?
The Infostealer and Malware Market
The biggest factor is the infostealer and malware market, which has been “nothing short of revolutionary for criminals,” according to Stuart Holder, Senior Analyst at Cybercheck.
“Infostealer malware delivers vast volumes of valuable data from compromised devices, databases and user accounts. At the same time, the market has scaled to the point where stolen records are often available at very low cost, and in some cases are distributed for free.”
— Stuart Holder, Senior Analyst, Cybercheck
Every new credential harvested by an infostealer represents a potential route into personal accounts, business systems, and sensitive corporate data. The growing availability of this information has fundamentally changed the economics of cybercrime, making it easier than ever for criminals to access and exploit stolen identities.
Growing Digital Footprints
The success of infostealer malware has also been accelerated by the fact that people rely on digital services more than ever before. Cybersecurity solutions provider NordPass estimates that the average person manages up to 170 passwords. With individuals using more personal and business accounts across more devices, the amount of personal and corporate data available to attackers continues to grow.
As digital identities expand, so does the volume of information that can be harvested, traded, and weaponized by cybercriminals.
The Shift to Cloud-Based Operations
Another contributing factor is the shift towards cloud-based business operations.
“Most organizations now rely on cloud services to store and manage critical data. This means that a single breach, particularly a ransomware attack, can expose vast quantities of information, including company records, documents and other valuable data.”
— Stuart Holder, Senior Analyst, Cybercheck
The result is that successful attacks are generating richer and more comprehensive datasets than ever before.
An Evolving Criminal Ecosystem
At the same time, the criminal ecosystem responsible for distributing stolen data has continued to evolve.
“There are more opportunities than ever for criminals to buy and sell stolen information. Many operators are building profitable businesses around the collection and distribution of compromised data.”
— Stuart Holder, Senior Analyst, Cybercheck
Today, the trade in stolen credentials and personal information spans traditional dark web marketplaces, invitation-only forums, encrypted messaging applications and direct peer-to-peer transactions. These Channels help criminals reach wider audiences while making enforcement efforts more difficult.
While combo lists remain one of the most popular methods of distributing stolen credentials, cybercriminals are also increasingly repackaging and redistributing data from historic breaches. By combining information from multiple sources, criminals can create larger and more attractive datasets that extend the lifespan and value of previously compromised information.
Why This Matters
The rapid growth from 300 billion to 400 billion recovered records demonstrates how quickly the cybercriminal economy is expanding. For organizations, it is a reminder that stolen data remains a persistent threat long after an initial breach occurs.
As cybercriminals continue to industrialize the collection and trade of compromised data, visibility into stolen credentials has never been more important. Understanding what information is circulating in criminal communities is a critical step towards reducing cyber risk and preventing account compromise before it leads to broader business impact.
