Account Takeover Statistics 2026: Why Ecommerce and Media Companies Cannot Wait

Account takeover (ATO) and credential stuffing surged in 2024–2025: automated bot traffic, massive combo lists (~24B credential pairs), and residential proxy usage drove triple-digit growth in attack volume, disproportionately affecting ecommerce and digital media; measured impacts include hundreds of millions to billions in industry losses and average per-incident retail fraud of ~$442 (all-in ~$1,200–$1,800). The report recommends defenses with documented effectiveness—phishing-resistant passkeys/FIDO2, adaptive MFA, bot mitigation and device intelligence—and highlights that coverage and tuning (targeting high-value accounts first) determine real-world reduction in successful ATOs.