airproducts.com Domain Breach Exposure Report

The telemetry indicates a significant exposure of 55,326 historical data breaches and 2,383 active infostealer logs targeting airproducts.com over the period of July 2025 to June 2026. The majority of infostealer activity is attributed to the Redline malware family, with a notable presence of LummaC2, Rhadamanthys, and Vidar. The data suggests a broad impact, with 53,466 employee credentials and 4,243 client credentials compromised. The primary services targeted include the airproducts.com domain itself, its login portals, and ADFS infrastructure, with the United States and Netherlands being the most affected geographies. The exposure appears to stem from combolist sources and database dumps, indicating credential stuffing or reuse of compromised credentials. The high volume of historical data breaches and active infostealer logs, coupled with the targeting of employee and client credentials, presents a critical risk of further account compromise, data exfiltration, and potential business disruption. Prioritization should focus on immediate remediation of exposed credentials, particularly those associated with employee and client accounts. A comprehensive review of access controls and authentication mechanisms for targeted services, including the airproducts.com login portals and ADFS, is recommended. Given the prevalence of Redline and LummaC2, endpoint security and malware detection should be enhanced. Investigating the sources of combolists and database dumps may reveal further attack vectors or compromised systems. The timeline shows a peak in employee and client credential exposure in September 2025 and January 2026, suggesting these periods require particular attention for incident response and forensic analysis.