centene.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting centene.com, with a total of 68,340 recorded events over the period from July 2025 to June 2026. The majority of these events, 96.9%, are classified as historical data breaches, totaling 66,242 instances. Additionally, there are 2,098 active infostealer logs, representing 3.1% of the total events. The timeline shows a substantial increase in employee-related events in January 2026, with 30,821 occurrences, and a peak in client-related events in September 2025, with 787 instances. Malware analysis reveals Redline as the predominant family, accounting for 80.6% of identified malware, followed by LummaC2 at 5%. Targeted services include centene.com itself and its single sign-on (SSO) and VPN portals, with the United States being the most frequently observed country in the breakdown. The high volume of historical data breaches and active infostealer logs, coupled with the critical risk score of 100 and the critical asset booster being enabled, signifies a severe and immediate threat. The prevalence of Redline infostealer suggests a focus on credential harvesting, potentially leading to further account compromise and unauthorized access. Remediation efforts should prioritize strengthening access controls for SSO and VPN services, enhancing endpoint security to detect and mitigate infostealer activity, and conducting thorough investigations into the root causes of the historical data breaches to prevent recurrence. Given the nature of the domain and the services targeted, the primary focus should be on protecting sensitive employee and client data.