In the login page of my software, there are 3 input fields - organization, username, and password. There isn't an option to register, but the registration is done by the organization manager. Currently, the error message when the credentials are wrong is "The username or password is not correct". My question is - the message also appears when the organization doesn't exist and it is confusing (security wise, I can't present which of the fields is wrong), what would be the ideal message in this case?
Usually login error messages avoid specifying whether it was the username or password that was the problem. This is because they don't want to give away information to third parties on the correct usernames that are in the system. The more information that a third party can get, the more likely it is that they can find a way to compromise your system.
Do you want third parties to be able to guess the names of the organisations that are using your system? Could this information be used to create phishing emails?
I would go for something really generic like "Login details are incorrect".