bancsabadell.com Domain Breach Exposure Report

The telemetry indicates a significant exposure of client data, with 106,805 client records compromised, alongside 6,712 employee records. This exposure is primarily driven by historical data breaches (87.2%) and active infostealer logs (12.8%). The timeline shows a notable surge in employee and client compromises in January 2026, with subsequent spikes in March and April 2026. Malware families like Redline, LummaC2, and Acreed are frequently observed, suggesting active credential harvesting. The majority of exposed data originates from combolist sources (94.1%), indicating credential stuffing or reuse attacks. The primary geographic origin of the telemetry is Spain, with a smaller presence in Pakistan and the United Kingdom. Given the high volume of client and employee data compromised, coupled with the active presence of infostealers and the nature of the data sources (combolists), this incident poses a critical risk. The focus for remediation should be on immediate incident response to contain active infostealer threats, comprehensive credential hygiene for both employees and clients, and a thorough review of access controls and data protection mechanisms. Prioritizing the investigation into the January 2026 spike is crucial for understanding the initial compromise vector and preventing recurrence.