Flare Research: Stolen FinServ Credentials Up 56% in 2026

Credential theft targeting financial services has moved from a background noise problem to a systemic risk. New research from Flare shows that between September 2025 and August 2026, more than 422,000 stealer logs containing banking and FinServ credentials were traded on underground forums across North America — a 56.3% increase year over year. For CISOs in banking, fintech and payment infrastructure, the exposure now reaches beyond customer accounts into the operator consoles that run entire card and payment platforms.

What was announced

Flare, the leader in identity-first Cyber Threat Intelligence (CTI), released new research quantifying the scale of stolen financial services credentials across the United States, Canada and Mexico. The study analyzed stealer logs from infected machines geolocated in North America and shared on criminal forums between September 2024 and August 2026.

Key figures from the report: 422,747 stealer logs with FinServ credentials in the latest 12-month window, up from 270,444 the year before. Monthly volume peaked at 50,541 in March 2026 and has since stabilized around 37,000 to 40,000 logs — roughly double the earlier baseline. The U.S. drove most of the increase at 83.1% year-over-year growth, Canada grew 77.9%, and Mexico declined 4.8%.

Most critically, Flare identified about 2,000 infected machines with operator access to card-issuing consoles, core banking vendors and payment rails. Card program platforms account for roughly half of those.

The overall volume tells us the problem is growing, but the infected machines of bank staff and infrastructure operators are where compromised credentials can do the most damage. One infected laptop with access to a card-issuing platform or a core banking vendor can put many institutions at risk at once. Those are the credentials security teams need to find first.

Why this matters

For CIOs, CISOs and procurement leaders in financial services, the Flare data reframes credential exposure as a supply chain problem. When one infected endpoint belongs to an employee of a card-issuing vendor or core banking provider, a single compromise can cascade across every bank or fintech running on that platform.

Flare also found 2,644 logs that paired a financial platform login with a corporate email address from the same company — a strong indicator the infected device belonged to an employee. At one major U.S. bank, nearly 40% of these employee-linked machines held credentials for internal staff systems, and fewer than 7% held only a personal banking login. Routine infections on personal devices are becoming entry points into the bank itself.

Technical details

• Volume: 422,747 FinServ stealer logs over 12 months, up 56.3% year over year.
• Operator exposure: about 2,000 infected machines with access to card-issuing, core banking and payment rails systems.
• Employee-linked logs: 2,644 instances pairing financial platform logins with corporate email from the same company.
• Regional dynamics: U.S. +83.1%, Canada +77.9%, Mexico -4.8% year over year.
• Infrastructure risk tier: around 3,300 logs tied to businesses using treasury and ACH/wire payment systems — a middle layer between consumers and operators.
• Platform categories: fintech and specialist platforms in 85.2% of logs, traditional banks in 36.2%, investment and wealth in 22.6%.
• Recommended actions: separate corporate from customer exposure, prioritize banking infrastructure credentials, extend monitoring to vendors and subsidiaries.

Softprom and Flare

Softprom is the official distributor of Flare. Financial services organizations and MSSPs can access Flare's identity-first CTI platform, which continuously monitors stealer logs, criminal forums and dark web sources to detect high-risk identity exposures before they are weaponized.

This content was prepared as part of the Softprom DistriFlow project — an automated system for monitoring and adapting vendor news. Original source: original article.