criteo.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting criteo.com, with 13,484 total events observed between July 2025 and June 2026. The majority of these events, 11,846, are classified as historical data breaches, while 1,638 are active infostealer logs. The data suggests a substantial risk to both employees (5,443) and clients (8,041) due to these breaches and the presence of infostealer activity. The timeline shows a notable spike in employee and client events in January 2026, followed by a surge in client events in March 2026. The primary sources of data compromise appear to be combolist sources (67.8%) and database dumps (32.2%), with malware families like LummaC2 and Redline being prevalent. Given the high volume of data breaches and active infostealer logs, this situation warrants immediate attention. The exposure of employee and client data, coupled with the prevalence of infostealers, poses a severe risk of credential compromise, identity theft, and further downstream attacks. Prioritization should focus on incident response, forensic investigation to understand the full scope of the data breaches, and immediate remediation efforts to secure affected systems and credentials. The targeted services include critical login and account management endpoints, highlighting the potential for account takeover. The geographical breakdown shows activity originating from China, Türkiye, and Vietnam, which should inform threat hunting and network monitoring efforts.