delfi.lv Domain Breach Exposure Report

The telemetry indicates a significant exposure event affecting delfi.lv, with a high volume of historical data breaches (13,927) and active infostealer logs (728) observed over the period of July 2025 to June 2026. The data breaches represent 95% of the total events, while infostealer activity accounts for the remaining 5%. Employee-related exposures peaked in September 2025 and February 2026, with client-related exposures showing a notable increase in March 2026. The most prevalent malware families associated with this activity are Redline, LummaC2, and Rhadamanthys, all known for their credential-stealing capabilities. The primary sources of leaked data appear to be combolist sources and database dumps, suggesting compromised credentials and potentially sensitive information have been exfiltrated. Given the high number of data breaches and the presence of active infostealer logs, this situation poses a critical risk. The prevalence of infostealer malware targeting employee and client accounts necessitates immediate attention to credential hygiene, endpoint security, and incident response capabilities. Prioritization should focus on identifying the root cause of the data breaches, mitigating ongoing infostealer infections, and implementing robust measures to prevent future compromise of employee and client data. The targeted services, including delfi.lv and its subdomains like calis.delfi.lv, indicate a broad impact across the organization's digital footprint.