SpyCloud’s 2026 Identity Exposure Report Reveals Explosion of Non-Human Identity Theft

SpyCloud’s 2026 Identity Exposure Report documents a substantial increase in exposed identity assets—65.7 billion distinct records—including 18.1M exposed API keys/tokens, 6.2M AI-related credentials, 28.6M phished identities (about half corporate), 8.6B stolen cookies/session artifacts, 642.4M credentials from infostealer infections, and 5.3B credential pairs; the report warns that attackers are increasingly exploiting machine identities and session tokens to bypass MFA, gain persistent access, and scale attacks across cloud and enterprise environments.