chewy.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting chewy.com, with a total of 202,807 recorded events over the period from July 2025 to June 2026. The majority of these events, approximately 85%, are classified as historical data breaches, while the remaining 15% are active infostealer logs. A notable surge in employee-related events occurred in January 2026, with 6,174 incidents, alongside a substantial increase in client-related events throughout the period, particularly in March 2026 with 50,659 incidents. The data also shows a high prevalence of infostealer malware families such as Rhadamanthys, Redline, and LummaC2, suggesting potential credential harvesting and unauthorized access attempts. The primary sources of leaked data appear to be combolist sources (96%) and database dumps (4%). Given the high volume of historical data breaches and active infostealer logs, this situation presents a critical risk to chewy.com. The concentration of events, particularly the spike in employee-related incidents in January 2026 and the ongoing client data exposure, necessitates immediate attention. Remediation efforts should focus on strengthening credential security, enhancing data breach detection and response capabilities, and investigating the root causes of the infostealer activity. Prioritizing the investigation of the combolist sources and database dumps is crucial for understanding the scope of the compromise and mitigating further damage.