Attackers acquire sensitive data mostly through credential phishing. Some other common methods for credential theft include ransomware, brute force attacks and purchase on the dark web.