biogen.com Domain Breach Exposure Report

The telemetry indicates a significant exposure for biogen.com, with over 48,000 historical data breaches and nearly 2,400 active infostealer events detected between July 2025 and June 2026. The majority of these events are linked to "Combolist sources" and "Database dumps," suggesting credential stuffing or account takeover attempts. The primary malware families observed are Redline, Rhadamanthys, and LummaC2, all known for their ability to steal credentials and sensitive information. The exposure affects a large number of employees (49,325) and clients (1,606), with a notable spike in employee-related events in January 2026. Targeted services include biogen.com itself, various mobile applications (likely related to internal or client-facing services), and VPN/webmail portals, indicating a broad attack surface. The prevalence of older Windows operating systems (e.g., Windows 8 x32, Windows Server 2003) among the affected systems suggests potential vulnerabilities due to unpatched or unsupported software. Given the high volume of historical data breaches and active infostealer activity, coupled with the critical asset booster, this situation warrants immediate attention. The focus should be on credential hygiene, including mandatory password resets and multi-factor authentication enforcement for all employees and clients. Prioritize patching or upgrading vulnerable operating systems, especially those identified in the telemetry. Investigate the source of the "Combolist sources" and "Database dumps" to understand the extent of compromised credentials and implement enhanced monitoring for suspicious login activity across all targeted services, particularly VPN and webmail.