Flare Research Finds Stolen Financial Services Credentials Jumped 56% Across North America

Study shows about 2,000 infected machines hold operator access to card-issuing, core banking and payment platforms

MONTREAL, Oct. 14, 2026 (GLOBE NEWSWIRE) -- Flare, the leader in identity-first cyber threat intelligence (CTI), today released new research showing a sharp rise in the number of stolen financial services (FinServ) credentials across North America. Between September 2025 and August 2026, 422,747 stealer logs containing FinServ and banking credentials were shared on underground forums, up 56.3% from 270,444 the year before. After peaking at 50,541 in March 2026, monthly volume has held at roughly 37,000 to 40,000 logs, about double the earlier baseline.

Most of these logs contain consumer logins for payment apps, bank accounts and investment platforms. However, the research found that a small share carries much greater risk. Flare identified about 2,000 infected machines holding operator access to systems that banks depend on, including card-issuing consoles, core banking vendors and payment rails. Card program platforms account for roughly half of them. Because these systems serve many institutions at once, a single stolen credential can expose every bank or FinServ running on that platform.

"The overall volume tells us the problem is growing, but the infected machines of bank staff and infrastructure operators are where compromised credentials can do the most damage," said Estelle Ruellan, threat intelligence researcher at Flare. "One infected laptop with access to a card-issuing platform or a core banking vendor can put many institutions at risk at once. Those are the credentials security teams need to find first."

Flare also found 2,644 logs that paired a financial platform login with a corporate email address from the same company, a strong sign the infected device belonged to an employee. At one major U.S. bank, nearly 40% of these employee-linked machines held credentials for internal staff systems, and fewer than 7% held only a personal banking login. When a single infected device holds both personal and work credentials, a routine infection on an employee's computer can become an entry point into the bank itself.

Other Key Findings:

• The U.S. drove most of the increase. U.S. FinServ stealer logs rose 83.1% year over year, adding about 11,000 of the roughly 12,700 additional logs seen each month across North America.
• Canada's volume grew 77.9%, while Mexico's fell 4.8%, making Mexico the only country in the region to show a decline.
• Canada has the highest rate of employee-linked logs in North America, at about 1 in 100, roughly three times the rate in the U.S. and Mexico.
• Around 3,300 logs belonged to businesses using banking infrastructure platforms, including treasury systems that send ACH and wire payments, making them potential targets for wire fraud. This indicates a third risk tier between consumers and operators.
• Fintech and specialist platforms appear in 590,823 logs, or 85.2% of the sample, while traditional and established banks appear in 250,697 logs, or 36.2%. Investment, brokerage and wealth appear in 156,437 logs, or 22.6%.
  

Flare recommends that financial services organizations separate corporate exposure from customer exposure, prioritize banking infrastructure credentials for immediate triage, extend monitoring to vendor and subsidiary staff, and avoid relying on regional patterns alone when setting risk thresholds.

To learn more, read Flare’s report.

Methodology

The report analyzed stealer logs from infected machines geolocated in the United States, Mexico and Canada and shared between September 2024 and August 2026. Flare examined credentials across traditional banks, digital challenger banks, fintech specialist platforms, investment and wealth services, consumer credit and lending providers, and B2B banking infrastructure. A single log could appear in multiple categories.

About Flare

Flare is the platform that hundreds of organizations around the globe select to end the risk of account takeover, ransomware attacks and data breaches caused by human and non-human identity compromise. As the leader in identity-first Cyber Threat Intelligence (CTI), Flare helps detect high-risk identity exposures with the largest collection of stealer logs, criminal forums, and identity exposures in the industry. For more information, visit the website or start a free trial to experience the platform firsthand. Join our Discord community and explore Flare Academy to stay up-to-date on the latest in threat intelligence.

Media Contact
Geena Pickering
Look Left Marketing
flare@lookleftmarketing.com

Frequently Asked Questions

What is a stealer log?
A stealer log is data taken from a device infected with infostealer malware. These logs can contain usernames, passwords and other credentials tied to financial services, giving attackers access to customer accounts or, in some cases, systems used by financial institutions.

What types of financial services were most commonly exposed?
Fintech and specialist platforms were the most common category, appearing in 85.2% of logs. Traditional bank credentials appeared in more than one in three logs, while investment, brokerage and wealth credentials appeared in more than one in five.

What should financial services organizations do about this exposure?
Flare recommends separating corporate exposure from customer exposure, prioritizing banking infrastructure credentials for immediate triage, extending monitoring to vendor and subsidiary staff, and avoiding reliance on regional patterns alone when setting risk thresholds.