The IT Nerd

Findings from a report from NordLayer, a toggle-ready network security platform for business, reveal that credentials of Fortune 500 employees are being leaked on the dark web at an alarming rate, with the overall number of leaked credentials reaching nearly 10 million. The numbers are accelerating in 2026 — dated infostealer logs from this year show a new Fortune 500 credential appearing on the dark web every 100 seconds.

NordLayer analyzed findings from NordLayer Intelligence by NordStellar, a threat intelligence platform, which revealed that 9.96 million Fortune 500 employees’ credentials were leaked on the dark web. The research found that over 6.6 million unique corporate email addresses were exposed. 

The leaked credential sets analyzed in the research comprise combolists — re-purposed credentials obtained from data breaches and infostealer infections — and dated infostealer logs, the only sets that record when the data was collected. 

Analysis of infostealer logs shows that 130,000 Fortune 500 employee credentials were leaked on the dark web across roughly 147 days in 2026 alone. This amounts to a new Fortune 500 credential surfacing on the dark web every 100 seconds.

“The credential leaks that could be traced down to this year were harvested using infostealer malware,” says Andrius Buinovskis, cybersecurity expert at NordLayer. “Unlike ransomware, which typically targets specific organizations, infostealer campaigns are often more opportunistic, focusing on individual users rather than entire companies. This malware primarily hides within pirated software, gaming applications, fraudulent ads, fake captchas, and phishing emails.”

Almost all credentials harvested from browsers

According to Buinovskis, infostealers scrape data from users’ devices almost immediately after infection, stealing any credentials or credit card details they come across. The browser is their preferred hunting ground for users’ log-in information — of the analyzed 2026 infostealer logs that record a source application, 99% point to browsers.

“Infostealer malware is specifically designed to extract credentials from built-in browser password managers. Because standard browsers store this sensitive data in predictable local directories, it is an easy target for malware,” explains Buinovskis. “The vulnerability of these industry giants proves that even the best corporate defenses can be bypassed by a single employee’s habits. In the face of opportunistic malware, the browser has become the enterprise’s weakest link.”

Desk-heavy industries top infostealer exposure rates

2026 infostealer data analyzed in the research shows that mid-sized Fortune 500 companies record higher infostealer exposure rates than the largest employers. Companies in the mid-sized bands (between 5,000 and 25,000 employees) record the highest median credential leakage rate — 1.27 unique credentials per 1,000 employees — while the largest employers show the lowest rates. The highest per-employee credential leak rates come from mid-sized technology companies, topping out at 42 credentials per 1,000 employees.

By industry, media and entertainment companies show the highest median credential leakage rate at 10.59 per 1,000 employees, followed by telecommunications and technology at around 3. According to Vakaris Noreika, a cybersecurity expert at NordLayer Intelligence, the rates mirror the attack surface these industries expose — sectors where nearly every employee holds a corporate login and saves credentials in a browser present infostealers with more to harvest.

“Many Fortune 500 giants employ vast numbers of frontline staff — whether on factory floors or in retail outlets — who operate without a corporate inbox, naturally lowering the company’s overall credential footprint,” says Vakaris Noreika. “At the opposite end, companies operating in the media and entertainment, telecommunications, and technology industries are almost entirely desk based, meaning nearly every employee is a potential infostealer target — and that exposure accumulates fast.” 

Safeguarding against infostealers

Buinovskis highlights five main measures companies should implement to build an infostealer-resistant cybersecurity strategy. 

1. Secure the browser. Browsers are the main hunting ground for infostealers, yet consumer-grade browsers often lack robust security measures and the ability to enforce centralized security controls. To reduce the risk of users downloading infostealers, the browser must block malicious websites and prevent users from downloading infected files.
2. Implement proper password hygiene. “Abandon built-in browser password managers and ensure that employees are not reusing the same passwords for different accounts,” says Buinovskis. “Password reuse can turn a single leak into a total compromise. If an employee uses the same login for every work application, they’re not just losing one password to an infostealer — they’re handing over the keys to every company resource at once.”
3. Raise employees’ cybersecurity awareness. Cybersecurity is everyone’s responsibility — fostering this mindset is crucial to reduce user error where possible. When an employee understands how a single pirated file or a click on a link in a phishing email can compromise the entire company, it’s easier for them to shift from treating cybersecurity incidents like an IT problem and start seeing them as their own responsibility. 
4. Monitor the dark web for any company credential leaks. This enables companies to have a heads up as soon as possible, empowering them to quickly implement necessary remediation steps, like flagging compromised accounts, resetting passwords that appeared in the data leak, and keeping a close eye on any anomalies.
5. Adopt a zero-trust approach to security to reduce the fallout. “A comprehensive cybersecurity strategy is essential to minimize the impact of a data breach,” says Buinovskis. “Instead of automatically trusting users and devices, companies should embrace a zero-trust mindset and treat every login attempt as a potential threat until proven otherwise. By verifying every move, organizations can effectively stop threat actors from infiltrating the network, preventing a simple credential leak from turning into a major security breach.”

Methodology

NordLayer and NordLayer Intelligence by NordStellar analyzed leaked credentials and identified those tied to domains belonging to 2026 Fortune 500 companies, covering 500 companies and 3,692 corporate domains. Subsidiary brands were not included. The research began with 34.86 million raw records, which were deduplicated to 9.96 million unique email and password pairs, counted once per company. Each company was matched to its industry, revenue, and headcount. The leaked sets are made up of combolists and infostealer logs, and only the infostealer logs carry a collection date. About 130,000 of those dated records fall within roughly 147 days of 2026, which works out to about 1 new credential every 100 seconds. Per-employee exposure was calculated by dividing a company’s unique leaked emails by its headcount, then scaled to a rate per 1,000 staff and grouped by company size and by industry for comparison.