NordVPN and NordStellar: Research: Data breaches down, password theft up

Infostealers Surge as Cybercriminals Shift Tactics Away from Data Breaches

A growing threat is quietly eclipsing traditional data breaches as cybercriminals pivot to more efficient methods of stealing sensitive information. Research from NordVPN and NordStellar reveals that while compromised databases declined by 36% between 2024 and 2025 dropping from 4,804 to 3,069 infostealer malware logs surged by 35%, rising from 19.5 million to over 26 million in the same period.

Unlike high-profile breaches, infostealers operate stealthily, extracting saved passwords, browser cookies, autofill data, and session tokens directly from victims’ devices. Mantas Sabeckis, senior threat intelligence researcher at Nord Security, notes that while breaches may be decreasing, the shift to infostealers represents a more insidious risk: "A single infection can silently harvest everything, often without the victim ever knowing."

The trend aligns with findings from Cloudflare’s 2026 Threat Report, which highlights a broader shift in attacker behavior. Cybercriminals are prioritizing efficiency over sophistication, favoring stolen credentials over costly exploits. In 2025, infostealers harvested 624 million passwords 18 times more than the 34 million exposed in breaches. For email addresses, breaches leaked 542 million, while infostealers captured 380 million, with the gap narrowing rapidly.

Marijus Briedis, CTO at NordVPN, underscores the danger: "Breaches trigger alerts and remediation, but infostealers operate in silence. Victims often only discover the theft when their accounts are already compromised." The malware typically spreads through pirated software, fake downloads, and phishing emails, running undetected in the background.

While basic security measures such as password managers, software updates, and anti-malware tools can mitigate risks, awareness remains a critical gap. As Briedis points out, "Most people understand data breaches, but few recognize infostealers a threat that bypasses corporate defenses entirely."

Source: https://www.advanced-television.com/2026/03/18/research-data-breaches-down-password-theft-up/

Nord Security cybersecurity rating report: https://www.rankiteo.com/company/nordsecurity

NordStellar cybersecurity rating report: https://www.rankiteo.com/company/nordstellar

"id": "NORNOR1773829992",
"linkid": "nordsecurity, nordstellar",
"type": "Cyber Attack",
"date": "1/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'attack_vector': ['pirated software', 'fake downloads', 'phishing emails'],
 'data_breach': {'data_exfiltration': 'Yes',
                 'number_of_records_exposed': ['624 million passwords',
                                               '380 million email addresses'],
                 'personally_identifiable_information': 'Yes',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['passwords',
                                              'browser cookies',
                                              'autofill data',
                                              'session tokens',
                                              'email addresses']},
 'description': 'A growing threat is quietly eclipsing traditional data '
                'breaches as cybercriminals pivot to more efficient methods of '
                'stealing sensitive information. Infostealer malware logs '
                'surged by 35% between 2024 and 2025, rising from 19.5 million '
                'to over 26 million, while compromised databases declined by '
                '36% (from 4,804 to 3,069). Infostealers extract saved '
                'passwords, browser cookies, autofill data, and session tokens '
                'directly from victims’ devices, often without detection.',
 'impact': {'data_compromised': ['624 million passwords',
                                 '380 million email addresses'],
            'identity_theft_risk': 'High'},
 'lessons_learned': 'Infostealers operate stealthily and bypass corporate '
                    'defenses, posing a significant risk even as traditional '
                    'data breaches decline. Awareness and basic security '
                    'measures (password managers, software updates, '
                    'anti-malware tools) are critical for mitigation.',
 'motivation': 'Efficiency over sophistication, credential theft',
 'post_incident_analysis': {'root_causes': ['Shift in cybercriminal tactics '
                                            'toward efficiency',
                                            'Lack of awareness about '
                                            'infostealer threats',
                                            'Spread via pirated software, fake '
                                            'downloads, and phishing']},
 'recommendations': ['Use password managers',
                     'Keep software updated',
                     'Deploy anti-malware tools',
                     'Raise awareness about infostealer threats'],
 'references': [{'source': 'NordVPN and NordStellar Research'},
                {'source': 'Cloudflare’s 2026 Threat Report'}],
 'title': 'Infostealers Surge as Cybercriminals Shift Tactics Away from Data '
          'Breaches',
 'type': 'Infostealer Malware'}