alcoa.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting alcoa.com, with a total of 56,424 recorded events over the period from July 2025 to June 2026. The majority of these events, 96.7%, are classified as historical data breaches, totaling 54,542 instances. Additionally, there are 1,882 active infostealer logs, representing 3.3% of the total events. The data breaches are primarily linked to "Combolist sources" (72.4%) and "Database dumps" (27.6%), suggesting compromised credentials. Infostealer activity is dominated by the "Redline" malware family (95%), with smaller proportions of "LummaC2" and "Acreed". The targeted services include alcoa.com and its associated STS (Security Token Service) endpoints, with a notable concentration of affected operating systems being older 32-bit Windows versions, including Windows 7, 8, and Server 2003/2008. Given the high volume of historical data breaches and active infostealer logs, particularly those leveraging credential stuffing techniques and Redline malware, this situation presents a critical risk. The exposure of employee and client data, as evidenced by the event counts, necessitates immediate attention. Prioritization should focus on credential hygiene, including mandatory password resets for all employees and clients, and enhanced monitoring for suspicious access patterns targeting the STS infrastructure. A thorough investigation into the root cause of the data breaches and infostealer infections is crucial to prevent further compromise.