Credential theft is now the single biggest way businesses get breached. It beats out malware, unpatched software, and phishing links that drop malicious files onto a laptop. Credential theft is the leading initial access vector in confirmed breaches, ahead of exploited vulnerabilities and phishing, and among basic web application attacks, stolen credentials show up 88% of the time.
That number should change how you picture a breach. Most owners still imagine a hacker forcing their way past a firewall. That's not always what's happening anymore. Attackers are logging in with real usernames and passwords, often bought off a marketplace built entirely around stolen logins.
This guide covers how credential theft happens today, why MFA doesn't catch what it used to, what a stolen login costs a business your size, and how an IT partner should show up to help.
For years, IT security meant protecting the network. Firewalls, antivirus, a locked-down office connection. Everything inside that line was trusted. Everything outside it had to prove itself first.
That model made sense when work happened inside an office, on a company-owned machine, or behind company-owned hardware. But it doesn't hold up anymore. Your team logs into Microsoft 365, your CRM, and your accounting software from their home office, job sites, and phones at kids soccer practice.
That’s how identity has become such an important consideration for IT. The username and password sitting between an attacker and your business is now the entire defense, not one layer of it. A firewall can be flawless and still not matter if someone hands over working credentials on the way in. That shift is exactly why managed cybersecurity services built around identity, not just network defense, have become the priority for businesses that used to think of security as a hardware problem.
Most stolen credentials come from infostealer malware, a quiet program that infects a device (often a personal one) and copies every saved password, browser cookie, and autofill entry it can find. That haul gets packaged and sold on dark web marketplaces, sometimes for a few dollars a login.
Once a criminal buys a batch, there's no guessing involved. They already have working credentials. If your employee reused a personal password for a work account, that purchase might unlock your systems directly. A study of more than 19 billion leaked passwords found that 94% had been reused or duplicated somewhere else. One weak password on a personal shopping account from years ago can end up being the same password protecting a work email login today.
This is why password policy still matters even as attacks get more sophisticated. It's the cheapest fix on this entire list, and it's the one most businesses skip.
Most owners believe MFA closes the door on stolen credentials. Attackers now use a technique called adversary-in-the-middle phishing. An employee clicks a link that leads to a fake login page sitting between them and the real service. They type their password like normal and approve the MFA prompt like normal.
Behind the scenes, that fake page quietly passes everything through to the real login and captures the session token issued afterward, the piece of data that proves a user already authenticated. Whoever holds that token gets in without ever seeing a password or solving an MFA challenge themselves. Phishing kits built for exactly this purpose, with names like Tycoon 2FA, EvilProxy, and Evilginx, now target Microsoft 365 and Google Workspace directly, and the technical skill required to run one has dropped sharply.
Session hijacking was involved in 87% of successful cyberattacks in 2024 that happened after a valid MFA login.
MFA still stops plenty of basic attacks and should stay on. But treating it as the finish line, rather than one layer among several, is exactly the assumption attackers are counting on.
A stolen login rarely stays contained to one account. The most common next move is business email compromise: using that real, trusted email address to send fraudulent wire instructions, fake vendor invoices, or a payroll change request that looks completely legitimate because it came from where it was supposed to.
We actually saw this happen with a prospect-turned-client who came to us after their current IT provider dropped the ball three times in the same month, including an email access through the company’s business ClickUp account.
Business email compromise generated over $3 billion in reported U.S. losses last year across nearly 25,000 incidents, averaging around $123,000 per case. Small and mid-sized businesses are frequent targets precisely because they tend to have fewer checks on wire transfers and vendor changes.
The cost also compounds through time. Credential-related breaches cost an average of $4.81 million and take close to 300 days to identify and contain. For businesses handling client data under compliance obligations, that timeline turns a single stolen login into a notification and regulatory problem on top of the financial one.
NHere are some important first steps to take to improve your credential security:
As you can see, identity security is mostly discipline, applied consistently across the organization. If your current IT partner is neglecting any of this, we’d love to talk.
What is credential theft?
Credential theft is when an attacker obtains a real username and password, usually through malware, a data breach, or a phishing attack, and uses those credentials to log into a business system as if they were the legitimate user.
Does MFA prevent credential theft?
No. Attackers can steal the session token created after a user completes MFA, a technique called adversary-in-the-middle phishing, which grants access without needing to solve the MFA challenge again. Phishing-resistant options like passkeys are far harder to bypass this way.
How do I know if my business has been affected by credential theft?
Warning signs include login alerts from unfamiliar locations, employees reporting MFA prompts they didn't request, unexpected changes to email forwarding rules, or vendor invoices with altered payment details.
What should I do first if business credentials are stolen?
Reset the affected password immediately, revoke active sessions for that account, and check for any unauthorized changes to email rules, banking details, or user permissions. Then review how the credential was likely obtained so the same gap doesn't get exploited again.
Do small businesses need to worry about credential theft?
Yes. Small and mid-sized businesses are frequent BEC targets specifically because they often have fewer checks in place around wire transfers and vendor changes, making a stolen login more valuable to an attacker, not less.