Stolen Financial Credentials Surge 56% in North America as Cyber Threats Target Banking Infrastructure

Flare's latest research reveals a 56.3% surge in stolen financial services credentials across North America, totaling over 422,000 logs between September 2025 and August 2026. For fintech professionals, the discovery of thousands of infected machines with direct operator access to core banking and payment rails highlights a critical systemic vulnerability that extends far beyond simple consumer account theft.

What was announced

Flare’s research tracked the circulation of "stealer logs" on underground forums, identifying a sharp escalation in North American financial data exposure. Between September 2025 and August 2026, the volume of logs containing banking and fintech credentials reached 422,747, compared to 270,444 in the previous year. While monthly volumes peaked at 50,541 in March 2026, they have since stabilized at roughly double the historical baseline, ranging between 37,000 and 40,000 logs.

The geographical breakdown shows the United States driving the majority of this growth with an 83.1% year-over-year increase, adding approximately 11,000 new logs to the monthly average. Canada followed with 77.9% growth and the highest rate of employee-linked logs in the region, at approximately 1 in 100. Conversely, Mexico was the only country in the region to show a decline, with volumes falling 4.8%.

The research distinguishes between consumer risk and infrastructure risk. While 85.2% of logs involved fintech and specialist platforms, a more dangerous subset of 2,000 infected machines held operator access to card-issuing consoles, core banking vendors, and payment rails. Furthermore, Flare identified 2,644 logs where corporate email addresses were paired with financial platform logins on the same device, suggesting employee compromise. At one major U.S. bank, nearly 40% of these employee-linked machines provided access to internal staff systems rather than just personal banking logins.

The companies involved

Flare is a cybersecurity firm specializing in identity-first cyber threat intelligence (CTI). The company focuses on monitoring the dark web and underground forums to identify high-risk exposure of corporate and consumer credentials. By prioritizing the "identity" aspect of threat intelligence, Flare provides organizations with data regarding compromised accounts, specifically looking for instances where stolen credentials could lead to unauthorized system access or financial fraud.

In the current cybersecurity landscape, Flare occupies a niche that bridges the gap between general threat monitoring and financial risk management. As financial institutions increasingly move toward cloud-based and third-party infrastructure, the company’s focus on "stealer logs"—data packages exfiltrated by malware—has become a primary method for identifying breaches in real-time. The firm’s research indicates a strategic shift in how threat intelligence is utilized, moving away from broad volume metrics toward the identification of high-privilege access points. This approach is designed to help security teams prioritize the critical infrastructure logs over the hundreds of thousands of lower-risk consumer logins that typically flood threat feeds.

What this means

The shift from consumer-focused credential theft to infrastructure-level compromise represents a significant escalation in systemic risk for the fintech sector. While the sheer volume of stolen logins is concerning, the concentration of risk within third-party vendors and card-issuing platforms suggests that the industry's greatest vulnerability lies in its shared infrastructure. This puts immense pressure on core banking providers to implement more rigorous device-level security for their operators. The high rate of employee-linked logs in Canada also raises questions about the effectiveness of "bring your own device" (BYOD) policies within financial institutions, where personal infections are clearly bleeding into corporate environments.