If you've ever created an online account, there's a sobering reality you need to face: your credentials are likely already circulating in criminal databases. Our analysis of 26.9 billion breach records across 33,117 incidents reveals a troubling pattern in what cybercriminals value most—and it's worse than you think.
The Data Types Criminals Covet Most
Plaintext passwords dominate the breach landscape, appearing in 29,047 separate incidents. That's not a typo. Nearly 30,000 times, attackers have successfully extracted passwords in readable, unencrypted form. Email addresses follow close behind at 27,217 breaches, with URLs (often revealing browsing habits and authenticated sessions) matching that count exactly.
This isn't coincidental. These three data types form the holy trinity of account takeover attacks. With an email, password, and the services you use, criminals possess everything needed to impersonate you across the internet.
Consider the XSS.IS Combolist breach from February 2019: 2.47 billion records containing email addresses, usernames, and plaintext passwords. That single incident exposed more credentials than the entire population of China. The Misc Combolists collection adds another 1.9 billion email-password pairs, creating a cybercriminal's ready-made attack toolkit.
Why Plaintext Passwords Are A Security Catastrophe
Password hashes—cryptographically scrambled versions of passwords—appear in only 2,482 breaches. That's a stark contrast to the 29,047 incidents containing plaintext passwords. This gap reveals a fundamental security failure: companies are either storing passwords without encryption or attackers are successfully cracking even hashed passwords at an alarming rate.
When the Ga$$Pacc Collection leaked 518 million plaintext passwords in January 2020, it demonstrated how password reuse transforms a single breach into thousands of compromised accounts. Criminals automate credential stuffing attacks, testing stolen email-password combinations across banking sites, shopping platforms, and social media until they find matches.
The persistence of this problem is staggering. MySpace's 2008 breach still circulates with 301 million records. Passwords you created 15 years ago remain accessible to anyone with access to criminal forums.
Personal Information: The Long Game
Beyond credentials, attackers systematically harvest identity data. First names appear in 1,421 breaches, last names in 1,409, and phone numbers in 1,021 incidents. The Verifications.io breach alone exposed 722 million records containing email addresses, phone numbers, and full names.
This information enables sophisticated social engineering attacks. With your name, phone number, and email address, criminals can:
- Impersonate customer service representatives convincingly
- Reset passwords through security questions based on public data
- Create targeted phishing campaigns referencing your actual service providers
- Conduct SIM swapping attacks to intercept two-factor authentication codes
The Weibo breach of 503 million phone numbers demonstrates how single data types can be weaponized. Your phone number becomes a skeleton key when attackers combine it with data from other breaches.
The Stealer Log Economy Is Thriving
Of the 33,117 breaches tracked, 16,583 are classified as "stealer logs"—malware infections that extract saved passwords, cookies, and autofill data directly from your browser. Recent incidents like "FRESH ULPP 19-08-2026 Redline_Cl0ud4" containing 6.4 million records show this threat isn't theoretical—it's happening daily.
These logs are particularly dangerous because they capture:
- Currently valid session cookies that bypass login entirely
- Saved payment information from browser autofill
- Credentials stored by password managers integrated with browsers
- Digital fingerprints that help attackers evade fraud detection
Unlike database breaches that expose historical passwords, stealer logs capture whatever you're using right now.
Three Actions You Must Take Today
Stop reusing passwords immediately. With 29,047 breaches containing plaintext passwords, any credential used across multiple sites is compromised. Use a dedicated password manager to generate unique passwords for every account.
Enable authentication apps, not SMS-based two-factor authentication. With phone numbers exposed in over 1,000 breaches, SMS codes can be intercepted through SIM swapping. Authenticator apps remain secure even when your phone number is compromised.
Check your exposure—specifically, not generally. Knowing whether your email addresses appear in these 27 billion records transforms abstract statistics into actionable intelligence. Search your email addresses and phone numbers at LeakedSource to identify which breaches contain your data, so you know exactly which accounts to prioritize for password resets.
The 27 billion records in circulation aren't disappearing. They're being combined, refined, and weaponized every day. Understanding what data criminals already have about you is the first step toward taking it back.