SpyCloud’s 2026 Identity Exposure Report Reveals Explosion of Non-Human Identity Theft

SpyCloud’s 2026 Identity Exposure Report documents a major expansion in exposed human and non-human identities — reporting 65.7 billion distinct identity records recaptured, including 18.1M API keys/tokens, 8.6B session artifacts, 28.6M phished records, and hundreds of millions of credentials from infostealer infections — and warns that machine identities, session tokens, and MFA-bypass phishing have become core attack surfaces that enable large-scale account takeover and persistent access.