aep.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event affecting AEP.com, with 58,074 historical data breaches and 1,854 active infostealer logs observed between July 2025 and June 2026. The majority of these events, 96.9%, are attributed to historical data breaches, while 3.1% are active infostealer logs. Employee accounts were heavily targeted, with 58,467 compromised, alongside 1,461 client accounts. The primary malware family associated with these events is Redline, accounting for 93.4% of observed infostealer activity. This suggests a broad compromise, likely originating from credential stuffing or phishing attacks leveraging leaked credentials from "Combolist sources" and "Database dumps," which represent 63.5% and 36.5% of the leak repository data, respectively. The timeline shows a surge in employee compromises in September 2025 and January 2026, correlating with increased infostealer activity. The targeted services include the main domain aep.com and various Android customer applications, indicating a focus on both corporate access and customer data. The prevalence of older 32-bit Windows operating systems in the telemetry suggests potential vulnerabilities in legacy systems. The high volume of historical data breaches and active infostealer logs, coupled with the extensive compromise of employee and client accounts, presents a critical risk. The reliance on Redline infostealer and the significant presence of leaked credentials point towards a high likelihood of further account takeovers and potential financial or operational disruption. Prioritization should focus on immediate credential reset for all affected employees and clients, enhanced monitoring of AEP.com and associated customer applications for anomalous activity, and a comprehensive review of security controls for legacy systems and VPN access, particularly those identified as "Citrix" and "FortiNet VPN".