--- title: SpyCloud’s 2026 Identity Exposure Report Reveals... description: SpyCloud's 2026 Identity Exposure Report documents a sharp rise in non-human identity (NHI) theft, with 18.1 million exposed API keys and tokens and 6.2... canonical: https://daily.dev/posts/spycloud-s-2026-identity-exposure-report-reveals-explosion-of-non-human-identity-theft-k86s9auxw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SpyCloud’s 2026 Identity Exposure Report Reveals Explosion of Non-Human Identity Theft | daily.dev og:description: SpyCloud's 2026 Identity Exposure Report documents a sharp rise in non-human identity (NHI) theft, with 18.1 million exposed API keys and tokens and 6.2... og:url: https://daily.dev/posts/spycloud-s-2026-identity-exposure-report-reveals-explosion-of-non-human-identity-theft-k86s9auxw og:image: https://api.daily.dev/og/posts/k86s9AuxW.png og:image:alt: SpyCloud’s 2026 Identity Exposure Report Reveals Explosion of Non-Human Identity Theft og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SpyCloud’s 2026 Identity Exposure Report Reveals Explosion of Non-Human Identity Theft **[Latest Hacking News](https://daily.dev/sources/lhn)** · 6 min read · 0 upvotes · 0 comments ## Summary SpyCloud's 2026 Identity Exposure Report documents a sharp rise in non-human identity (NHI) theft, with 18.1 million exposed API keys and tokens and 6.2 million credentials tied to AI tools recaptured in 2025. The report highlights that attackers are increasingly targeting session tokens, authentication cookies, and machine credentials alongside traditional username/password pairs. Key findings include 8.6 billion stolen cookies and session artifacts, 642.4 million credentials from 13.2 million infostealer infections, phishing surging 400% YoY with 28.6 million phished records, and 80% of exposed corporate credentials containing plaintext passwords. The report warns that NHIs often lack MFA enforcement and rotate infrequently, making them high-value targets with broad access to cloud and enterprise systems. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [News alert: SpyCloud study reveal stolen tokens, session data fuel surge in non-human identity attacks](https://daily.dev/posts/news-alert-spycloud-study-reveal-stolen-tokens-session-data-fuel-surge-in-non-human-identity-attac-bqbd7ygdr) · Security Boulevard · 1 upvotes · 0 comments - [Ghost Credentials Expose Cloud Systems to Hidden Identity Risks](https://daily.dev/posts/ghost-credentials-expose-cloud-systems-to-hidden-identity-risks-vnwppykza) · Dark Reading · 0 upvotes · 0 comments - [What the Mythos-Ready Briefing Says About Credentials](https://daily.dev/posts/what-the-mythos-ready-briefing-says-about-credentials-hfpjp5qcv) · GitGuardian · 0 upvotes · 0 comments - [Governing the ghost workforce](https://daily.dev/posts/governing-the-ghost-workforce-54whzdqjq) · CSO Online · 0 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/spycloud-s-2026-identity-exposure-report-reveals-explosion-of-non-human-identity-theft-k86s9auxw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SpyCloud’s 2026 Identity Exposure Report Reveals Explosion of Non-Human Identity Theft","url":"https://daily.dev/posts/spycloud-s-2026-identity-exposure-report-reveals-explosion-of-non-human-identity-theft-k86s9auxw","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/spycloud-s-2026-identity-exposure-report-reveals-explosion-of-non-human-identity-theft-k86s9auxw"},"datePublished":"2026-03-19T13:42:54.179Z","dateModified":"2026-03-19T13:43:20.763Z","description":"SpyCloud's 2026 Identity Exposure Report documents a sharp rise in non-human identity (NHI) theft, with 18.1 million exposed API keys and tokens and 6.2...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/38e1d1373ab3d0035f0290f6733d8873?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/38e1d1373ab3d0035f0290f6733d8873?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Latest Hacking News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Latest Hacking News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/5110318ded6e43f1bb12facdeb2b1965","url":"https://daily.dev/sources/lhn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/spycloud-s-2026-identity-exposure-report-reveals-explosion-of-non-human-identity-theft-k86s9auxw","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,phishing","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Latest Hacking News","item":"https://daily.dev/sources/lhn"},{"@type":"ListItem","position":3,"name":"SpyCloud’s 2026 Identity Exposure Report Reveals Explosion of Non-Human Identity Theft"}]} ```