ana.co.jp Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting ana.co.jp, with a total of 85,038 recorded events over the period from July 2025 to June 2026. The majority of these events, 72,211, are classified as historical data breaches, while 12,827 are active infostealer logs. The data breaches primarily originate from "Combolist sources" (71,648 events), suggesting credential stuffing or similar attacks leveraging previously compromised credentials. Infostealer activity is linked to malware families such as LummaC2, Rhadamanthys, and Redline, indicating potential exfiltration of sensitive information. The timeline shows a notable increase in employee-related events in September 2025 and January 2026, coinciding with spikes in client-related events. The affected services are predominantly related to ana.co.jp and its subdomains, with Japan being the primary geographic origin of the observed activity. Given the high volume of historical data breaches and active infostealer logs, this situation presents a critical risk. The reliance on "Combolist sources" for data breaches points to a need to review and strengthen credential management and authentication mechanisms, including multi-factor authentication. The presence of multiple infostealer families targeting the domain suggests a persistent threat actor or multiple actors actively seeking to compromise user accounts and exfiltrate data. Prioritization should focus on immediate incident response to contain active infostealer infections, followed by a comprehensive review of security controls to prevent future credential compromise and data exfiltration.