cdc.gov Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting the cdc.gov domain between July 2025 and June 2026. A substantial volume of historical data breaches, accounting for 94.5% of all events, alongside active infostealer logs (5.5%), suggests a broad compromise. The data breach figures are particularly concerning, with 39,369 recorded events. Employee and client data appear to be the primary targets, with 29,136 employee-related events and 12,534 client-related events observed over the period. The timeline shows a sharp increase in employee-related events in September 2025 and January 2026, and client-related events in August 2025 and January 2026, indicating periods of heightened activity. The risk priority is extremely high due to the volume and nature of the data breaches and infostealer activity targeting a critical government health organization. The prevalence of malware families like Rhadamanthys, Redline, and LummaC2, commonly associated with credential harvesting and data exfiltration, further elevates the risk. Remediation efforts should focus on immediate containment of active infostealer threats, thorough investigation of the historical data breaches to understand the scope of compromised data and affected individuals, and strengthening security controls around targeted services such as vams.cdc.gov and tceols.cdc.gov, which appear to be frequently targeted. Given the nature of the domain, the closest industry sector is Healthcare & Pharma.