blackrock.com Domain Breach Exposure Report

The telemetry indicates a significant exposure of BlackRock employee and client credentials, with over 60,000 employee and 6,000 client credentials compromised. This is primarily driven by infostealer malware, particularly Redline, which accounts for over 74% of identified malware families. The data breaches are heavily concentrated in "Combolist sources" and "Database dumps," suggesting widespread credential stuffing and brute-force attacks leveraging previously compromised credentials. The timeline shows a notable surge in employee credential exposure during September 2025 and January 2026, with client credential exposure also peaking in September 2025. The targeted services include authentication endpoints for blackrock.com, indicating direct attempts to compromise user accounts. The prevalence of older Windows operating systems in the telemetry warrants attention for potential unpatched vulnerabilities.