change.org Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting change.org, with a total of 190,789 recorded events over the period of July 2025 to June 2026. The majority of these events, 169,894 (89%), are classified as historical data breaches, while 20,895 (11%) are active infostealer logs. The data breach events are predominantly linked to "Combolist sources" (99.6%), suggesting compromised credential reuse. Infostealer activity is driven by malware families such as Redline (17.2%), LummaC2 (13.4%), and Rhadamanthys (12.2%), which are known for exfiltrating sensitive information. The timeline shows a surge in client-related events in September 2025 and January-March 2026, coinciding with spikes in employee-related events in January and April 2026, indicating potential credential stuffing or phishing attacks targeting both user accounts and internal systems. Geographically, India, the United States, and Spain show the highest number of affected users. Given the high volume of data breaches and active infostealer logs, this situation presents a critical risk. The prevalence of combolists suggests that attackers are likely leveraging previously compromised credentials, potentially from other services, to gain access to change.org accounts. The active infostealer logs indicate ongoing attempts to exfiltrate data from compromised systems. The focus for remediation should be on immediate credential rotation for all affected users and employees, enhanced monitoring for suspicious login activity, and a review of access controls. Implementing multi-factor authentication across the platform is also a critical step to mitigate further unauthorized access. The nature of the affected domain, change.org, which facilitates online petitions and social activism, means that compromised accounts could be used for malicious purposes such as spreading disinformation or impersonation, amplifying the potential impact of this breach.