TL;DR: Verizon's 2025 DBIR doesn't publish a single "hours to first use" figure for stolen credentials, but it confirms credentials remain involved in roughly 22% of breaches and separately finds the median time to fix a leaked secret discovered in a public GitHub repository is 94 days.
Verizon's 2025 DBIR doesn't publish a single "hours to first use" figure for stolen credentials, but it confirms credentials remain involved in roughly 22% of breaches and separately finds the median time to fix a leaked secret discovered in a public GitHub repository is 94 days.
What the Data Shows
That 94-day window is a reminder that stolen credentials often stay usable for a long time after exposure, not just in the first few hours — which is exactly why checking whether your own email or phone number has already surfaced in a known breach is worth doing periodically, not just once.
Why This Matters
Numbers like these are a reminder that this isn’t a rare event — it’s a routine risk. Checking whether your own information has already been exposed takes 30 seconds and costs nothing.
If this looks similar to something else you've seen, it's worth reading How Long Does It Take to Recover From Identity Theft?.
This pattern shows up elsewhere too — see How Many Americans Have Been in a Data Breach?.
Frequently Asked Questions
What do the numbers actually show?
Verizon's 2025 DBIR doesn't publish a single "hours to first use" figure for stolen credentials, but it confirms credentials remain involved in roughly 22% of breaches and separately finds the median time to fix a leaked secret discovered in a public GitHub repository is 94 days.
What does this mean for you?
That 94-day window is a reminder that stolen credentials often stay usable for a long time after exposure, not just in the first few hours — which is exactly why checking whether your own email or phone number has already surfaced in a known breach is worth doing periodically, not just once.
Where does this data come from?
This data is drawn from Verizon – 2025 Data Breach Investigations Report, a primary reporting source for fraud and identity theft data.