Case Study: Unveiling 642,639 Government Credential Leaks Across 192 Countries
The Global Government Credential Leaks Study found 642,639 government credential leaks across 192 countries, collected from 83 dark web and Telegram sources. Brazil has the most leaks in total (165,241). Dominica has the most per capita (807.02 per 100,000 citizens), against a global average of 8.27.
WebThreat Research · Published · 4 min read
A WebThreat.io investigation into global cybersecurity risks on the dark web and Telegram.
The study's dashboard with the figures per country is at gov-leaks.webthreat.io.
What happens when the digital keys to government systems (your healthcare, elections, or national security) end up for sale on the dark web? At WebThreat.io, we’ve conducted the Global Government Credential Leaks Study to find out, diving into the murky depths of cybercrime. Our latest analysis, completed on May 2, 2025, at 01:56:19, uncovered 642,639 government credential leaks across 192 countries, sourced from over 83 dark web and Telegram platforms. This case study exposes a global crisis that demands immediate attention.
The Scope of Our Case Study: A Worldwide Analysis
Our team scoured 83 sources on the dark web and Telegram, both paid and public credential clouds, where infostealer malware dumps or sells stolen government credentials. The result is a staggering dataset of 642,639 leaks spanning 192 countries, providing an unparalleled view of global cybersecurity vulnerabilities.
Here’s the breakdown:
- Total Countries Analyzed: 192
- Total Credential Leaks Detected: 642,639
- Global Average: 8.27 leaks per 100,000 citizens
- Most Vulnerable Country: Dominica, with a shocking 807.02 leaks per 100,000 citizens
These figures aren’t just numbers, they’re a global alert. From Brazil to Dominica, the exposure of government credentials threatens the systems we all depend on.
Zooming In: Where the Leaks Strike Hardest
Our case study examines the data through two lenses: total leaks and leaks per 100,000 citizens, revealing both the scale and the intensity of the threat.
Top 15 Countries by Total Leaks
Brazil tops the list with 165,241 leaked credentials, followed by Indonesia (80,129) and the Philippines (72,632). The United States joins at seventh place with 20,413 leaks, reflecting its vast digital footprint. These large nations are prime targets due to their extensive infrastructure.
Top 15 Countries by Leaks per 100K Citizens
The per-capita view shifts the focus. Dominica leads with 807.02 leaks per 100,000 citizens, a figure that dwarfs the global average, followed by Georgia (243.67 leaks per 100K) and the United Arab Emirates (148.74 leaks per 100K). Smaller nations like Bhutan (149.78 leaks per 100K) and Bahrain (34.57 leaks per 100K) also stand out, highlighting how limited resources amplify cyber risks.
Dominica’s Dire Situation
Dominica, with a population of just 72,737, faces 587 total leaks, translating to 807.02 leaks per 100,000 citizens. This small Caribbean nation’s vulnerability could paralyze critical services (healthcare, governance, or disaster response), leaving it exposed in ways larger countries might mitigate. It’s a stark reminder of the uneven cyber threat landscape.
The Source: Dark Web and Telegram Exposed
The dark web and Telegram are hotbeds for cybercrime, where infostealer malware steals credentials and funnels them into credential clouds. Our team identified 83 such sources, ranging from exclusive paid marketplaces to public dumps, where 642,639 government credentials were exposed. These leaks are weapons in the hands of hackers, capable of enabling espionage, financial theft, or infrastructure sabotage. For governments, the stakes are existential.
Context: How Does This Compare?
While large-scale breaches have occurred before, our case study stands out. Group-IB’s 2018 report identified 40,000 government credentials across 30 countries, a mere fraction of our 642,639 across 192 nations. The 2024 “Mother of All Breaches” exposed 26 billion records, but it wasn’t specific to government credentials. Our focus on dark web and Telegram-sourced government leaks, with per-capita analysis, sets a new standard in cybersecurity research.
The Human Impact: A Personal Threat
Consider Brazil’s 165,241 leaks, enough to disrupt public services for over 215 million people, or the United States’ 20,413 leaks, which could compromise national security for 333 million citizens. In Dominica, 587 leaks could devastate a community of 72,737. With a global average of 8.27 leaks per 100,000 citizens, no nation, including Australia (76.6 leaks per 100K) or the UK (12.05 leaks per 100K), is immune. Your government’s exposure is your exposure.
Next Steps: A Call to Action
This case study is a call to arms:
- Government Defense: Deploy stronger measures like multi-factor authentication and regular audits.
- Global Partnership: Collaborate internationally to shut down dark web marketplaces.
- Public Advocacy: Demand transparency, because your data’s safety depends on it.
The Bigger Picture: A Global Wake-Up Call
The Global Government Credential Leaks Study reveals a fragile digital world. A single leaked credential can unravel a nation’s security. From Dominica to Brazil, the dark web’s reach is universal, and its impact is personal.
First published on Medium on 2 May 2025.
Terms used in this article
Sources
- Group-IB: state resource press release, Group-IB, accessed
- Cyber Apocalypse 2023: Is The World Heading For A Catastrophic Event?, Forbes, accessed
Related
Stolen-data ecosystem and actors
php2shell: the two critical PHP flaws and what to do now
php2shell is the name for two critical flaws in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. They can allow unauthenticated r...
Stolen-data ecosystem and actors
FBI Crushes Nulled & Cracked.io, but Cybercriminals Already Have a Backup Plan
After the January 2025 seizure of the forums Nulled.to and Cracked.io, cybercriminals are shifting stolen-data trading to Telegram “clouds”. The article explain...
Stolen-data ecosystem and actors
The Invisible Threat of Exfiltrated Data: Unmasking the Underworld of Telegram-Based Data Sales
Telegram channels are used to list and sell exfiltrated data and access to compromised machines. The article describes the sales workflow from C2 server to list...
See your leadership's exposure
CEM finds your executives from your company name, checks them against breach corpora and leak databases, and scores each person from 0 to 100.