For nineteen years the Verizon Data Breach Investigations Report told the same story in different words: stolen credentials were the most common way an attacker got inside. In the 2026 edition that changes. Exploiting a vulnerability has overtaken credential theft as the leading initial access route, for the first time in the report’s own history.
Credentials have not stopped mattering. They have stopped being the only door, and the attackers who still want them have got better at taking them without ever asking you for one.
What the shift actually shows
Unpatched software is now the cheaper way in, as Help Net Security’s summary of the 2026 report sets out. Only 26 percent of the vulnerabilities on CISA’s known exploited list had been fully remediated across 13,000 organisations surveyed, down from 38 percent the year before. Defenders are not keeping up with the flaws attackers already use.
Ransomware grew to 48 percent of breaches, up from 44, though 69 percent of victims did not pay. The credential route has not vanished either. Stolen logins are packaged and sold by initial access brokers, and infostealers feed that pipeline. Half of the ransomware victims who had a prior credential leak were attacked within 95 days of the leak.
That market is why patching and login hygiene keep turning up in the same sentence. An access broker sells a working login, so the buyer never has to phish anybody. They skip the front door, land inside, and spend their time on privilege escalation and deployment while the account still looks legitimate to every alerting rule pointed at it.
The account you forgot about
Third-party involvement jumped 60 percent year on year and now accounts for nearly half of all breaches. Supplier portals, marketing tools, an agency with a login to your reporting dashboard. Only 23 percent of third-party organisations had fully fixed their MFA issues at all, and weak passwords and permission misconfigurations took close to eight months to resolve for half of the findings.
If you run any kind of account with money behind it, that is the relevant paragraph. Your password can be strong and your supplier’s can be reused.
Not all MFA is the same thing
Multi-factor authentication is the obvious answer and the answer is not uniform. Microsoft’s guidance on phishing-resistant MFA sets out the split: methods bound to a device or a cryptographic key resist a fake login page, while a one-time code typed into a real-looking site does not. Passkeys and hardware keys sit in the first group. Texts and codes read out over the phone sit in the second.
Practical version: turn on the strongest factor the service offers, not the most convenient one, and treat any request to read out a code as an attack until proven otherwise.
The methods also fail in different ways. A code can be phished in real time, and push notifications can be spammed until somebody taps approve out of exhaustion. Microsoft’s guidance treats that fatigue as a live attack pattern rather than a user error, which is the argument for authenticators that cannot be talked into approving anything.
What this looks like on a trading account
The platform you trade on carries some of this for you. MetaTrader 5, for instance, uses encryption and authentication features designed to help protect account and user information, and Blueberry’s MT5 page describes how to open a live or demo account. That is the baseline. It is not the whole of your exposure.
Automated strategies are the part traders add themselves. Expert Advisors are executable code, and installing one from an unverified source is handing over your account with extra steps. The same applies to plug-ins, indicator bundles and copy-trading signals that require your login rather than a connection the broker controls.
Then the boring controls that catch what technology misses: a unique password on the trading account, a different one on the email tied to it, statements read monthly rather than assumed, and withdrawal permissions checked. Read the statement yourself. Nobody else is going to notice a withdrawal you did not make.
The short version
– Patch the software you actually run, including the router and the plugins.
– Use passkeys or a hardware key where you can, codes where you cannot.
– Never install trading tools that want your password instead of an API key.
– Read the monthly statement properly.
– Assume a supplier with a login is part of your attack surface.
None of this makes an account unbreakable. It removes the easy paths, which is what most of these breaches are.