VINGELIS◆ BY CAMACHO — home

Stolen logins: the door attackers use most

Most attacks do not start with a spectacular technique. They start with someone logging in.

Published 16.10.2026

33%

of breaches at small and medium organisations involved stolen credentials (Verizon DBIR 2025, global data)

> 1/3

of Swiss SMEs reuse passwords across services (FHNW, 2024)

73

business email compromise cases in the second half of 2025, against 49 a year earlier

Credentials as the entry point

In Verizon's 2025 report, stolen credentials were involved in 33% of breaches at small and medium organisations, and ransomware in 88% of them. These are global figures, not Swiss ones, but they match what Swiss authorities describe.

The same pattern in Switzerland

The FHNW study found that more than a third of SMEs reuse passwords across several services and that password managers are under-used. In the first half of 2026 the NCSC saw more Microsoft 365 phishing aimed at taking over business mailboxes, sometimes posing as the IT helpdesk or a senior manager.

An access question, not only a technology one

Who has access to what, whether multi-factor authentication is on, what happens when someone changes role or leaves: these are identity and access questions. They are mostly organisational, and they are where a small company can act first. The NCSC recommends multi-factor authentication and up-to-date systems.

Identity and access management is not only for large groups. A short review of who can access what is a sensible first step.

Sources

We summarise; we do not reproduce. Sources consulted on 16.10.2026. These texts inform: they are not legal advice, and an average figure does not predict what will happen to a given company.

Want to know where you stand?

Take the self-checkWrite to usAll articles