Skip to content
Submit incident

Malware and credential theft incidents

Definition

Malware and credential theft incidents document malicious code that harvests personal data, passwords, payment cards or session tokens, from infostealers on employee devices to skimming scripts on checkout pages.

Included

  • Infostealer infections that led to a wider breach
  • Payment card skimming on websites or terminals
  • Spyware or trojans that collected personal data
  • Theft of credentials or tokens later used to reach personal data

Excluded

  • Malware campaigns with no identified organization or affected people
  • Ransomware, which has its own category
Malware and credential theft incidents over time
Documented incidents per year of occurrence. 2026 to date.
Unit: incidents · Source: Data Incident Index v2026.09 · Counts reflect documented incidents, not prevalence · *2026 to date

Incident records14

Oct 2026Australia severs criminal access to 180,000 computers after breaching Amadey malware backendReportedMalware and credential theftDataBreaches.netnews.lavx.huOct 2026Over 543,000 valid credentials exposed in public GitHub repositoriesReportedMalware and credential theftDataBreaches.netbleepingcomputer.comOct 2026Suspected State Hackers Exploited Citrix NetScaler for Weeks. 50,000 Devices May Still Be Exposed.ReportedMalware and credential theftDataBreaches.netdatawater.comApr 2026Claude Code leak used to push infostealer malware on GitHubReportedMalware and credential theftDataBreaches.netbleepingcomputer.comNov 2025Shai-Hulud malware infects 500 npm packages, leaks secrets on GitHubReportedMalware and credential theftDataBreaches.netbleepingcomputer.comNov 2025Kr: Investigation shows KT concealed malware infections, security failures leading to hacking breachReportedMalware and credential theftDataBreaches.neten.yna.co.krJun 2025No, the 16 billion credentials leak is not a new data breach - a wake-up call about fake news (Updated)ReportedMalware and credential theftDataBreaches.netbleepingcomputer.comcybernews.com+1Feb 2025$10 Infostealers Are Breaching Critical US Security: Military and Even the FBI HitReportedMalware and credential theftDataBreaches.netinfostealers.comhackread.comFeb 2024Millions of hacked toothbrushes used in Swiss cyber attack (1)ReportedMalware and credential theftDataBreaches.netaargauerzeitung.chindependent.co.uk+1Jan 2024Zero-day, supply-chain attacks drove data breach high for 2023ReportedMalware and credential theftDataBreaches.netcsoonline.comidtheftcenter.orgDec 2023Hackers Exploited ColdFusion Vulnerability to Breach Federal Agency ServersReportedMalware and credential theftDataBreaches.netthehackernews.comcisa.govNov 2023MOVEit hackers leverage new zero-day bug to breach organizations (CVE-2023-47246)ReportedMalware and credential theftDataBreaches.nethelpnetsecurity.comOct 2023University of Tokyo PC Infected with Malware in July 2022; Possible Leak of Students’ Addresses, GradesReportedMalware and credential theftDataBreaches.netjapannews.yomiuri.co.jpAug 2023Over 100K hacking forums accounts exposed by info-stealing malwareReportedMalware and credential theftDataBreaches.nethudsonrock.combleepingcomputer.com
Browse all incidents →