Google and UCB study: from March 2016 to March 2017, 788K credentials were stolen via keyloggers, 12M credentials via phishing, and 3.3B via 3rd-party breaches
Posted by Kurt Thomas, Anti-Abuse Research; Angelika Moscicki, Account Security — Account takeover, or ‘hijacking’ …
Context & Ripple Effects
The Google–UCB hijacking study gave the industry its first large-scale map of where stolen credentials actually come from: third-party breaches dwarf everything else, with 3.3B exposed versus 12M phished and 788K keylogged over the study year. The implication was that most account takeover is breach-reuse, not targeted attacks on the victim's own device.
That measurement shaped Google's subsequent security roadmap: internal deployment of physical Security Keys, then the consumer-facing Password Checkup tool, and ultimately the push to replace passwords altogether with passkeys.
First-order effects
- Google's Anti-Abuse Research team reframed account takeover defense around detecting reused breached credentials rather than endpoint malware, since breach leakage accounted for the overwhelming majority of exposed logins.
- Users of any service that suffered a third-party breach became the primary at-risk population, regardless of their own password hygiene on that site.
Second-order effects
- Akamai's finding that 43% of tracked login requests involved credential abuse confirmed attackers were industrializing exactly this breach-reuse vector with bots, forcing sites to add breach-correlation defenses like Google's Password Checkup extension, which found 1.5% of website logins using compromised credentials.
- Phishing-resistant hardware moved from niche to corporate standard after Google reported zero successful phishes against its 85,000+ employees once Security Keys were mandated.
Third-order effects
- If the pattern holds, the industry's endgame is removing the reusable secret itself: Google's passkeys rollout across 400M+ accounts shows credential-theft economics collapsing as authentication shifts to phishing-resistant, per-site cryptographic keys.
- Credential databases held by third parties stop being master keys when they no longer contain replayable passwords, restructuring breach liability away from downstream account takeover.
The trend: Account security is migrating from patching password reuse toward eliminating passwords entirely, with each stage — measurement, breach-alerting, hardware keys, passkeys — building on the last.