[New research] Learn what 6 billion compromised passwords mean for your organization’s security in 2026

The Specops research team have launched the 2026 Breached Password Report, which contains analysis of over six billion malware stolen passwords. The launch of the report also coincides with the latest addition of over 1.3 billion passwords to the Specops Breached Password Protection service, taking the total number of passwords to over 5.5 billion.

Commenting on the report, Darren James, Senior Product Manager for Specops, said:

“Despite years of awareness training and increasingly complex password policies, attackers are still encountering the same weak and predictable credentials across systems. This isn’t just a volume problem, it’s evidence that static password controls don’t reflect how credentials are actually stolen, reused, and operationalized today. Password strength comes from length, often achieved through the use of passphrases, paired with continuous checks for compromised passwords, not from complexity alone.

The data shows that many of these passwords already meet standard length and complexity requirements. They aren’t being cracked, they’re being harvested, aggregated, and reused at scale. Without continuous visibility into compromised credentials inside Active Directory, organizations remain blind to one of the most reliable and repeatable access paths attackers use today.”

Breached Password Report key highlights

Over the past year, Specops has focused its research on one of the most reliable access paths used by attackers today, credential theft via malware. By analyzing real-world password data from active infostealer campaigns, the report shows why traditional password policies are no longer sufficient on their own.

This research helps organizations understand how password-based attacks really unfold, which credentials are most frequently compromised, where gaps in visibility within Active Directory leave environments exposed, and provides actionable recommendations to strengthen password security and reduce risk.

Key findings include:

• The top 5 most commonly stolen passwords in 2025
• Popular malware used by hackers to steal credentials
• The top lengths of stolen passwords
• The most common base terms found in compromised passwords.

For full details, download your free copy of the 2026 Breached Password Report here.

Report methodology

Data in this report comes from the Threat Intelligence team at Outpost24, Specops Software’s parent company. In total, over six billion stolen passwords were captured and analyzed over a 12-month period between January and December 2025.

Does your organization have breached passwords?

If you’re looking for insights into your organization’s password health, Specops Password Auditor is a free tool that give you answers in minutes. This free, read-only scan of your AD shows how many passwords are compromised or reused, along with a complimentary report detailing common vulnerabilities like weak policies, breached credentials, and inactive accounts.

Are compromised passwords lurking in your AD? Audit your AD with our free tool!

Continuous defense against compromised passwords

Specops Password Auditor offers an excellent snapshot of password risks present in your organization, but it is only a first step. With Specops Password Policy and Breached Password Protection, you can continuously protect your organization against over 5 billion breached passwords. This includes ‘strong’ passwords that have been stolen and could be used in attacks.

Updated daily with real-world attack data, the Breached Password Protection feature helps defend your network against active password threats. Continuous AD scanning detects breached passwords, while customizable user alerts speed remediation and reduce service desk calls.

If you’re interested in how this could work in your organization or have questions about how to adapt it for your needs, contact us now. In the meantime, download our report to understand the latest threats to password security.

Password attacks are on the rise. The 2026 Breached Password Report has insights into just how vulnerable passwords truly are.