Password & Credential Sharing Statistics 2025

More than half of IT leaders share passwords with employees via email — up from 39% just one year prior. Remote and hybrid work made "just email it" the default. Email stores everything permanently: the original send, every reply, every forward. A password emailed in 2022 is still sitting in multiple inboxes today.

Stolen credentials are the single largest initial access vector in data breaches, responsible for 22% of all incidents. Attackers don't need to exploit vulnerabilities when credentials are freely circulating in email archives and chat histories. The attack surface is created by the workflow, not the attacker.

Credential-based breaches take an average of 246 days to identify and contain — more than eight months of undetected access. Every day an attacker operates with legitimate credentials, they can move laterally, exfiltrate data, and compromise additional accounts. The cost reflects this: $4.67M on average, $230,000 above the already-record global average.

Email delivers 52% of all endpoint malware. Teams that share credentials via email are using the most-targeted attack channel as their primary access distribution mechanism. The same inbox that receives a password also receives phishing attempts designed to steal it.