aecom.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event affecting AECOM, with over 155,000 total recorded events between July 2025 and June 2026. The majority of these events, approximately 95%, are classified as historical data breaches, while the remaining 5% are active infostealer logs. Employee-related events account for the largest portion of the exposure, with over 107,000 instances, followed by client-related events at over 48,000. The timeline shows a sharp increase in employee and client events in January 2026, and a notable rise in client events in March 2026. Malware analysis reveals Redline and LummaC2 as the most prevalent families, often associated with credential harvesting. The high volume of historical data breaches and active infostealer logs, coupled with the large number of employee and client events, suggests a widespread compromise. The prevalence of credential-stealing malware like Redline and LummaC2 points to a risk of account takeover and further data exfiltration. The targeted services include the AECOM jobs portal, indicating potential phishing or credential stuffing attacks aimed at recruitment systems. Remediation should focus on comprehensive credential hygiene, including mandatory multi-factor authentication, enhanced monitoring for suspicious login activity, and user education on phishing awareness, particularly concerning the identified malware families and targeted services.