NordLayer Finds Fortune 500 Credentials Leaked Daily
News related to:NordLayer · 3 min read
NEW YORK, Oct. 01, 2026 /CourierPR/ -- NordLayer research reveals that credentials of Fortune 500 employees are being leaked on the dark web at an alarming rate, with the overall number of leaked credentials reaching nearly 10 million. The numbers are accelerating in 2026, as dated infostealer logs from this year show a new Fortune 500 credential appearing on the dark web every 100 seconds.
The research, conducted by NordLayer, a toggle-ready network security platform for business, analyzed findings from NordLayer Intelligence by NordStellar, a threat intelligence platform. This platform revealed that 9.96 million Fortune 500 employees’ credentials were leaked on the dark web. The research found that over 6.6 million unique corporate email addresses were exposed.
The leaked credential sets analyzed in the research comprise combolists, re-purposed credentials obtained from data breaches and infostealer infections, and dated infostealer logs, the only sets that record when the data was collected. Analysis of infostealer logs shows that 130,000 Fortune 500 employee credentials were leaked on the dark web across roughly 147 days in 2026 alone, amounting to a new Fortune 500 credential surfacing on the dark web every 100 seconds.
Andrius Buinovskis, a cybersecurity expert at NordLayer, explained that the credential leaks that could be traced back to this year were harvested using infostealer malware. Unlike ransomware, which typically targets specific organizations, infostealer campaigns are often more opportunistic, focusing on individual users rather than entire companies. This malware primarily hides within pirated software, gaming applications, fraudulent ads, fake captchas, and phishing emails.
Infostealer malware is specifically designed to extract credentials from built-in browser password managers. Because standard browsers store this sensitive data in predictable local directories, it is an easy target for malware. The vulnerability of these industry giants proves that even the best corporate defenses can be bypassed by a single employee’s habits. In the face of opportunistic malware, the browser has become the enterprise’s weakest link.
NordLayer’s research found that mid-sized Fortune 500 companies record higher infostealer exposure rates than the largest employers. Companies in the mid-sized bands (between 5,000 and 25,000 employees) record the highest median credential leakage rate, 1.27 unique credentials per 1,000 employees, while the largest employers show the lowest rates. The highest per-employee credential leak rates come from mid-sized technology companies, topping out at 42 credentials per 1,000 employees.
By industry, media and entertainment companies show the highest median credential leakage rate at 10.59 per 1,000 employees, followed by telecommunications and technology at around 3. According to Vakaris Noreika, a cybersecurity expert at NordLayer Intelligence, the rates mirror the attack surface these industries expose, sectors where nearly every employee holds a corporate login and saves credentials in a browser, present infostealers with more to harvest.
Many Fortune 500 giants employ vast numbers of frontline staff, whether on factory floors or in retail outlets, who operate without a corporate inbox, naturally lowering the company’s overall credential footprint. At the opposite end, companies operating in the media and entertainment, telecommunications, and technology industries are almost entirely desk-based, meaning nearly every employee is a potential infostealer target, and that exposure accumulates fast.
NordLayer’s cybersecurity expert, Andrius Buinovskis, highlights five main measures companies should implement to build an infostealer-resistant cybersecurity strategy. These include securing the browser, implementing proper password hygiene, raising employees’ cybersecurity awareness, monitoring the dark web for any company credential leaks, and adopting a zero-trust approach to security to reduce the fallout.
To read the full report, please visit nordlayer.com/fortune-500-infostealer-research.