SpyCloud 2026 Identity Exposure Report Release

SpyCloud released its annual 2026 Identity Exposure Report, revealing a 23% increase in recaptured identity data, totaling 65.7 billion records. The report emphasizes a structural shift in cyber threats, with attackers increasingly targeting non-human identities (NHIs) like API keys and session tokens, in addition to traditional credentials. SpyCloud recaptured 18.1 million exposed API keys and tokens and 6.2 million credentials tied to AI tools in 2025. The report also notes a surge in phishing attacks, with 28.6 million phished identity records, nearly half of which were corporate users. Session theft remains prevalent, with 8.6 billion stolen cookies and session artifacts exposed. Infostealer malware contributed over 642.4 million exposed credentials from 13.2 million infections. The report underscores the need for continuous identity threat protection for both human and machine identities, as attackers combine various data sources to fuel cybercrime. European Union===Europol, with Microsoft's support, disrupted the Tycoon 2FA phishing-as-a-service infrastructure, an effort SpyCloud contributed to.