Fraudsters Stole 52 Billion Cookies in a Year — Here's Why That Matters

Cybersecurity firm NordVPN identified 52 billion cookies in stolen data circulating online in the year to June. That staggering figure — roughly six stolen cookies for every person on Earth — comes from Marijus Briedis, the company's chief technology officer, and it frames a fraud problem most people have never heard of: cookie theft.

"Cookies have become the primary target for hackers," Briedis says. The technique belongs to a family of fraud known as session hijacking, and it sidesteps the two defenses most of us rely on: strong passwords and multifactor authentication.

How a session cookie becomes a stolen key

When you log into a website — your bank, for example — the site places a unique "session cookie" on your device. It stores your data temporarily so you can move from page to page without re-entering your login details every time. Log out, and the cookie stops working.

The vulnerability sits in what happens while the session stays open. If you choose "remember me" on a website, or you don't properly close the session, that cookie keeps working long after you've walked away.

"Think of a session cookie as a digital key that's already turned in the lock," Briedis says. "When you stay logged into a site, that cookie is what keeps the door open for you. If a hacker steals that active cookie, they essentially become you."

"They don't need your password, they don't trigger a login alert, and they can often bypass your multifactor authentication (MFA)," he adds.

The theft itself usually starts with malware you've inadvertently downloaded. "Once that malware is on your device, it goes straight for your browser's database, grabs all those active session cookies, and sends them back to the hacker," Briedis explains. "They're essentially reaching into your digital pocket and grabbing your keys while you're not looking."

What does an attack actually look like?

From the victim's side, it looks like nothing at all. You logged in, entered your password, maybe passed an MFA check — and then closed your laptop thinking the work was done. You may only discover the breach later, when the damage appears.

The consequences depend on the account. With social media or email, scammers can use your identity to trick other people. With your bank, fraudsters can access the account directly or harvest details for an impersonation scam. If you were shopping online, they can change and redirect your order and charge it to your saved payment details.

Sometimes a security alert gives you the first clue — a message asking whether you tried to change your account details, for instance.

What does this change for how you work online?

The practical answer: your login habits matter more than your password strength. Briedis and the NordVPN guidance point to a concrete checklist:

• Be careful with browser extensions and software downloads — that's where infostealer malware usually hides.
• Watch for infection red flags: a device suddenly struggling with simple tasks, faster battery drain, frequent crashes, or a browser behaving oddly with redirects, pop-ups or a changed homepage.
• Avoid insecure public wifi for anything requiring a login. The chance of cookie theft through this channel is low, but caution still pays.
• Log out of accounts manually. "Just closing a tab doesn't end the session," Briedis says. "You need to manually log out to invalidate that cookie and make it useless to a thief."
• Move passwords out of your browser and into a dedicated password manager.
• Clear your cookies regularly to shrink what's available to steal.

If you suspect you've been compromised, run an antivirus scan, log out of your accounts on every device, and change your passwords. Keep MFA switched on — it still offers more protection than a password alone. And alert your bank the moment you notice suspicious payments.

The uncomfortable takeaway for practitioners and consumers alike: authentication is only as strong as the session behind it. As long as 52 billion stolen cookies are floating around, the logout button may be the most underrated security tool you own.