We checked 99 companies for leaked logins. All 99 had them

All 99 companies we checked had leaked employee logins. Seventy-five of them had a leaked login for their own sign-on systems.

On 30 October 2026 we ran 100 well-known organisations through our own index. Forty were software companies, thirty were among the largest international law firms and thirty were US hospital systems. We searched each one by its email domain, the same lookup anyone can run from our homepage. One hospital system came back with almost nothing. When we checked, we'd used a domain its staff don't send email from, so we dropped it. That leaves 99.

On its own that isn't news. Any organisation with a few thousand staff will have some. What we didn't expect was how recent most of it was, and how often the leaked login was for the company's own sign-in page rather than some forum an employee joined years ago.

We're not naming any of the companies. Most of them have bigger security teams than a typical company has staff, so this isn't a list of careless firms. It's what the problem looks like even when a company is doing a lot right.

The numbers

• 123,447 leaked records tied to work email addresses, covering 43,789 accounts. Six companies hit our 10,000-result limit, so the real total is higher.
• Every one of the 99 had at least one record posted in the last 90 days.
• 94 had full stealer-log entries, where malware on a computer copied the login straight out of the browser.
• 75 had a leaked login for one of the company's own websites, or for its own account on Okta, Salesforce, ServiceNow, Atlassian or Slack.
• 80 had work addresses used on Netflix, Facebook, Discord, Roblox or other personal sites. 38 had them on gaming sites.

Most of it is from the last year

It's easy to assume leaked passwords are old breach data nobody uses any more. Some of this was. About 2,600 records were dated January 2021 or January 2022, older lists that keep getting passed around.

But 89% of the dated records were posted on or after 1 December 2025. January 2026 alone accounted for 21,850 of them.

A posting date isn't the date a password was stolen. Criminal channels repost each other's material, and a log can circulate for a while before it lands somewhere we collect from. Still, someone decided these logins were worth posting this year. People don't usually bother with logins they think are dead.

Logins for the company's own front door

A leaked Netflix password that belongs to someone in accounts payable is a problem for that person. A leaked login for the company's single sign-on page is a problem for the company.

75 of the 99 had at least one login like that.

• 34 had a login for a sign-on host on their own domain, the kind named sso, sts, adfs or login.
• 33 had a login for their own Okta account, the company-specific address employees use to reach every other app.
• 15 had a login for a remote access gateway or staff portal.
• 9 had a login for their own mail server.

Software companies were worst here, 35 of 40, which makes sense given how many of them put every app behind Okta. Hospital systems were close behind at 26 of 29. Law firms were lowest at 14 of 30.

Multi-factor authentication stops a password on its own. It helps a lot less if the attacker also has the session cookie, and the stealer logs these lines come from usually carry cookies too. So a sign-on login in a stealer log needs more than a password reset. Revoke the sessions and look at the device. We wrote up what to do in the first 24 hours.

Whose computer was it?

Infostealers mostly spread through cracked software, game cheats and fake downloads, the same pattern CISA and the FBI describe for common info stealers. When a work login turns up next to Roblox, Epic Games or Steam logins from the same address, the likely story is a home computer the whole family uses, where someone also checked work email.

38 of the 99 companies had work addresses saved on gaming sites. In hospital systems it was 19 of 29, and Epic Games alone showed up at 12 of them.

Hospitals had two more sites the other sectors didn't. The American Heart Association's training portal, where clinical staff renew CPR and life-support certifications, appeared at 14 of 29. ID.me appeared at 13. Neither is a security problem by itself. What they show is that these were the computers people ran their actual working lives on.

56 of the 99 also had logins saved by Android apps, the Gmail app most often. These most likely came from a phone's saved passwords syncing to a Google account that was also signed in on an infected computer. One infected laptop can give up the passwords from a phone that was never infected at all.

The same few channels carry most of it

The records came from 76 different sources, nearly all of them Telegram channels and Telegram bots. The median company turned up in 25 of them.

It isn't spread evenly, though. Four sources carried 58% of all the records, and 90 of the 99 companies appeared in all four. The top ten carried 85%.

That matters if you're deciding whether monitoring is worth doing. You don't need to watch hundreds of channels to catch most of what gets posted about your company. You need the handful that carry most of the volume.

One address, 101 websites

17% of the accounts we could see had logins saved for two or more websites. One work address had logins for 101 different sites.

Law firms had the highest share, 27% of accounts, even though only 11% of their records came from stealer logs.

By sector

Hospital systems employ far more people than the software companies and law firms here, so the raw counts mostly track headcount. The percentages are the fairer comparison.

What we'd do with this

• Search your login pages, not only your email domain. A contractor using a personal Gmail address on your VPN portal won't show up in a search for @yourcompany.com. Here's how to check both.
• Treat a sign-on or VPN login in a stealer log as an incident, not a password reset ticket.
• Decide what you allow on personal computers. If staff can open work email on a home PC their kids also use, some of those PCs are infected right now.
• Check more than once. Every company here had something posted in the last 90 days, so a clean result in spring says little about autumn.

How we did this

• We searched 100 organisations by email domain on 30 October 2026, using the BreachDetect index of stealer logs, combolists and breach dumps. We dropped one after finding we'd searched the wrong email domain.
• We picked well-known names in each sector, not a random sample. Treat these as examples rather than an average for every company.
• A record is one leaked login, an email address and a password, usually with the website it was for. We split records into stealer-log entries and combo lines the way our index labels them. 82% of the combo lines also named a website, which is the format stealer logs get cut down to before they're resold. So the stealer-log share above understates how much of this started on an infected computer.
• Searches stop at 10,000 records per domain. Six organisations hit that, so their figures are a minimum.
• Posted means the date a record was posted to the source we collected it from.
• We only counted. We didn't keep any email addresses or passwords from this research, and we didn't try any of the logins.

You can run the same check on your own domain from our homepage. It's free and it never shows passwords.