americanexpress.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting americanexpress.com, characterized by over 1 million historical data breaches and over 170,000 active infostealer logs. The majority of these events are linked to "Combolist sources" within leak repositories, suggesting credential stuffing or account takeover attempts. Malware families such as Redline, LummaC2, and Rhadamanthys are prevalent, indicating active compromise and data exfiltration. The timeline shows a surge in employee and client-related events in late 2025 and early 2026, with notable spikes in January and March 2026. The targeted services include the main americanexpress.com domain and its login portals, with the United States being the primary geographic origin of the observed activity. Given the high volume of data breaches and active infostealer logs, coupled with the involvement of common credential-harvesting malware, this situation presents a critical risk to the organization and its users. The focus for remediation should be on immediate credential hygiene, including widespread password resets for both employees and clients, enhanced monitoring for suspicious login activity, and a thorough review of security controls related to data exfiltration and credential compromise. The prevalence of "Combolist sources" suggests a need to investigate how these credentials were initially compromised and to strengthen defenses against such attacks.