Google and UCB study: from March 2016 to March 2017, 788K credentials were stolen via keyloggers, 12M credentials via phishing, and 3.3B via 3rd-party breaches
Posted by Kurt Thomas, Anti-Abuse Research; Angelika Moscicki, Account Security — Account takeover, or ‘hijacking’ …
Context & Ripple Effects
The Google–UC Berkeley measurement put hard numbers on a problem the industry had mostly discussed anecdotally: over twelve months, third-party breaches exposed 3.3 billion credentials — thousands of times more than the 788K taken by keyloggers and the 12M by phishing. The finding reframed account takeover as primarily a credential-reuse problem, not a malware-interception problem.
That framing set up everything Google published on the topic afterward: its own workforce went passwordless against phishing with physical Security Keys, the Password Checkup extension turned breach-corpus matching into a consumer browser feature, and by 2024 Google was reporting 400M+ accounts on passkeys. This study is the baseline datapoint for that whole arc.
First-order effects
- Users whose passwords appeared in third-party breach dumps — the dominant vector at 3.3B credentials — became the priority population for Google's anti-abuse and Account Security teams, shifting detection effort from endpoint malware toward cross-site credential matching.
Second-order effects
- Akamai's finding that 43% of 17B login requests involved credential abuse showed attackers industrializing exactly the reuse channel the study quantified, pressuring sites beyond Google to validate logins against breach corpora rather than trust the password alone.
Third-order effects
- If stolen-password reuse stays the top hijack vector, authentication structurally migrates away from shared secrets entirely — the path Google itself walked from Security Keys to passkeys, where possession-based factors remove the reusable credential that breaches expose.
The trend: Account security is moving from password hygiene and breach-alerting toward phishing-resistant, possession-based authentication, with Google's product trajectory from this study through passkeys marking each stage.