box.net Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting box.net, with over 11,000 total events logged between July 2025 and June 2026. The majority of these events, over 10,000, are classified as historical data breaches, with a substantial number, over 900, also identified as active infostealer logs. The timeline shows a surge in client-related events in March 2026, alongside employee-related events in January 2026. Malware families such as LummaC2, Redline, and Acreed are prominently featured, suggesting a sophisticated threat actor or multiple coordinated campaigns. The data also points to "Combolist sources" as the primary leak repository classification, indicating credential stuffing or account takeover attempts. Given the high volume of data breaches and active infostealer logs, coupled with the prevalence of credential-related leaks, this exposure poses a critical risk. The primary focus for remediation should be on credential hygiene, including mandatory password resets, multi-factor authentication enforcement for all users, and enhanced monitoring for suspicious login activity originating from affected geographies, particularly the United States, Spain, and France. Investigating the root cause of the data breaches and infostealer infections is paramount to prevent further compromise.