Access credentials are information used to prove identity when connecting to a system or service. They commonly include usernames and passwords, but may also be API keys, authentication tokens, or other secret values. Possessing valid credentials can allow access under the permissions assigned to the associated account.
In cyber attacks, stolen or exposed credentials can let an attacker sign in, impersonate a user, or reach connected systems without exploiting a software flaw. Their actual reach depends on validity, account privileges, and protections such as multifactor authentication. Defenders should promptly verify suspected exposure, revoke or rotate affected secrets, review sign-in activity, and limit accounts to the access they need. Credentials should be stored securely and never treated as proof that a system was compromised unless access is confirmed.