corebridgefinancial.com Domain Breach Exposure Report

The telemetry indicates a significant exposure of client and employee data, with 1796 historical data breaches and 868 active infostealer logs observed over the period from July 2025 to June 2026. The majority of these events, 67.4%, are attributed to historical data breaches, while 32.6% are linked to active infostealer activity. The data suggests a concentrated attack on client-facing portals, with multiple login and registration endpoints for services like Connext and LifePortal being targeted. Malware families such as Rhadamanthys, Acreed, and LummaC2 are prevalent, indicating a sophisticated threat landscape. The primary affected geography is the United States, with a notable presence of Windows 11 operating systems among the compromised systems. The high volume of data breaches and active infostealer logs, coupled with the targeting of client portals, presents a critical risk to Corebridge Financial. The prevalence of infostealer malware suggests a direct threat to credential theft and potential account takeover. Prioritization should focus on immediate remediation of identified vulnerabilities in client portals, enhancing endpoint security to detect and prevent infostealer infections, and conducting thorough investigations into the historical data breaches to understand the full scope of compromised information and affected individuals. The presence of "Combolist sources" and "Database dumps" in leak repositories further underscores the severity of the data exposure.