citigroup.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting citigroup.com, with over 114,000 historical data breaches and nearly 4,600 active infostealer logs detected within the reporting period. The majority of these events are classified as historical data breaches, with a smaller but concerning portion attributed to active infostealer activity. The timeline shows a substantial spike in employee and client-related events in January 2026, suggesting a potential peak in compromise activity during that month. The primary malware families associated with the infostealer logs are Redline, LummaC2, and Vidar, all known for credential harvesting. Targeted services include secure mail and access portals, indicating a focus on gaining access to sensitive user accounts. The leak repository classification points to both combolist sources and database dumps as origins of exposed data, with a near even split between the two. Given the high volume of historical data breaches and the presence of active infostealer logs targeting employee and client credentials, this incident warrants immediate attention. The prevalence of Redline and LummaC2 suggests a sophisticated threat actor or multiple actors leveraging common, effective infostealing tools. Prioritization should focus on identifying the root cause of the historical breaches, containing the active infostealer infections, and assessing the full scope of compromised credentials and data. Remediation efforts should include credential reset campaigns for affected employees and clients, enhanced monitoring of critical access points, and a review of data security protocols to prevent future occurrences.