A database discovered in June 2026 contained 24 billion stolen records. Most of them came from malware that copies everything out of web browsers: saved passwords, active logins, cloud account tokens, and the cookies that keep you signed in all day. This isn't about one big breach. It's about how attackers are now getting into businesses, and it changes what you need to watch for.
What gets stolen from a browser
When someone on your team clicks a fake software update or installs a malicious browser extension, the malware copies out more than passwords. It grabs active sessions, which means the attacker can use your accounts without ever needing to log in. They inherit your identity.
Your browser remembers which cloud services you're signed into, which SaaS tools you use, and which VPNs you connect through. All of that can be copied and sold. An attacker who buys that package doesn't have to guess a password or get past two-factor authentication. They just pick up where you left off.
This is why stolen credentials keep showing up at the start of ransomware attacks and business email compromise incidents. The attacker looks like a real user, so traditional security tools don't notice anything wrong.
What this looks like in a small business
Let's say someone in your office downloads a cracked copy of software they thought would save money, or clicks through a convincing installer for a free AI tool. Within hours, everything stored in their browser is copied to a server overseas.
A week later, someone logs into your Microsoft 365 account from another country. They don't need your password because they have the session token. Two-factor authentication never fires. They forward a few emails to an external address, download your client list, or send an invoice redirect to one of your customers.
You might not know anything happened until a client calls to ask why your payment details changed, or until you notice files you didn't upload in your cloud storage.
What to do about it
Start by assuming some of your passwords are already out there. The goal is to make stolen credentials less useful.
Turn on multi-factor authentication everywhere you can, especially for email, accounting software, and cloud storage. The kind that uses an app or hardware key is better than SMS, but any MFA is better than none.
Limit what each person can access. If someone's account gets taken over, you want the damage contained. Not everyone needs admin rights, and not everyone needs access to every file.
Watch for unusual account activity. Logins from new locations, forwarding rules you didn't set up, or files being downloaded in bulk are all signs worth checking. If your IT provider isn't already monitoring for this, ask them to start.
The browser is part of your security perimeter now
For years, browsers were just the window you used to get work done. Now they hold the keys to your business systems.
That means you need to treat them differently. Block risky extensions, keep browsers updated, and make sure your team knows that fake updates and cracked software are common ways this malware spreads.
If you're working with a managed IT provider, ask them what they're doing to detect account takeovers and compromised sessions. Not every provider is watching for this yet, but it's becoming one of the most common ways attackers get in.
This is already happening
The 24-billion-record database isn't an outlier. It's a snapshot of an economy that's been running for years. Stolen browser data is being bought, sold, and used to break into businesses every day.
Most of the defences you need are not complicated. They're about adding friction in the right places so that a stolen session or leaked password doesn't automatically mean a successful attack.
If your business is still relying on passwords alone, or if you're not monitoring your accounts for takeover activity, you're leaving the door open. The good news is that closing it doesn't require a complete overhaul. It just requires treating your browser like the business tool it's become.
