Back

burlington.com Domain Breach Exposure Report

Risk Score

High Risk

Massive event volume or critical assets compromised.

AI Findings Summary

Critical

The telemetry indicates a significant exposure of employee and client data, with 44,047 historical data breaches and 2,806 active infostealer logs observed between July 2025 and June 2026. The majority of these events are linked to combolist sources and database dumps, suggesting credential stuffing and data leakage as primary attack vectors. Malware analysis reveals a strong prevalence of Redline, Rhadamanthys, and LummaC2 infostealers, which are commonly used to exfiltrate credentials and sensitive information. The targeted services are predominantly related to the burlington.com domain, including its login pages, indicating a direct focus on the organization's online presence and user accounts. Geographically, the United States, Netherlands, and Germany show the highest concentration of these events.

Total Events

46,853
credential exposure events

Employee Affected Events

40,756
account email domain = burlington.com

Client Affected Events

6,097
service target = burlington.com

Free Community Account

Stop stolen credentials from logging in

Own this domain? Create a free Lunar account to see full exposure data and evidence.

12-Month Events Timeline

Event volume by breach date, employee VS client

EmployeesClients
10,0006,6673,3330
peak month 9,334
Jul 25Sep 25Nov 25Jan 26Mar 26May 26Jun 26

Infostealers VS Data Breaches

Live stealer logs VS data breaches

Infostealer logs
Events2,806
Share6%
Data breaches
Events44,047
Share94%
Infostealer logs (6%)
2,806events
Data breaches (94%)
44,047events

40,756 compromised employee accounts pose an infrastructure risk, while 6,097 leaked client credentials create regulatory liability.

Antivirus Distribution

Security Tools on Infected Endpoints

Windows Defender4
Avira1

Malware Families Distribution

Distribution of Active Stealer Strains

Redline1,819
Rhadamanthys196
LummaC2153
Vidar72
Acreed47
StealC7
Remus7
Millenium5
Raccoon3

Top Login URLs

Top exposed services found in the event results

  1. 1burlington.com930
  2. 2https://www.burlington.com/Login.aspx539
  3. 3https://burlington.com356
  4. 4burlington.com/Login.aspx351
  5. 5https://www.burlington.com329
  6. 6www.burlington.com/Login.aspx242
  7. 7burlington.com/login.aspx232
  8. 8www.burlington.com197
  9. 9app.burlington.com/account/login195
  10. 10https://app.burlington.com/account/login171

Infostealer By Geography

Shows the distribution of Infostealer-related credential exposure events across different geographic regions. The location is determined by analyzing the metadata of the infected machines associated with each event.

United States
Events855
Netherlands
Events398
Germany
Events358
Denmark
Events179
United Kingdom
Events43
Switzerland
Events34
Sweden
Events28

Country Breakdown

  1. 1United States855
  2. 2Netherlands398
  3. 3Germany358
  4. 4Denmark179
  5. 5United Kingdom43
  6. 6Luxembourg37
  7. 7Switzerland34
  8. 8Sweden28

Services Classification Distribution

Blast radius - closer to core = more critical infrastructure, size = credential volume

Microsoft1,487
Citrix78
FortiNet VPN27
Cisco (AnyConnect)16
Pulse Secure13
Git11

Operating System Distribution

Distribution of compromised endpoint builds

Windows Server 2012 x32138
Windows 10 Home x32127
Windows Server 2008 R2 x32127
Windows Server 2003 R2 x32126
Windows Server 2012 R2 x32123

Leak Repository Classification

Where the exposed records currently reside

0
Named breaches
39,422
Combolist pools
4,625
Unattributed dumps

Disclaimer: This report includes AI-generated content. AI can make mistakes, so verify important findings independently before taking action.