devonenergy.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting Devon Energy, with 3,339 historical data breaches and 24 active infostealer logs observed over the reporting period. The majority of these events, 92.1%, are linked to database dumps, with an additional 7.9% originating from combolist sources. Malware families such as Blank Grabber, Vidar, and Redline were detected, primarily targeting Windows operating systems. The exposure is heavily concentrated around the careers portal, specifically job listings and talent community subscription pages, suggesting a potential compromise of recruitment-related data or systems. A notable surge in employee-related events occurred in January 2026, coinciding with a large number of client-related events in March 2026, indicating a potential escalation or widespread impact during these periods. Given the high volume of historical data breaches and active infostealer logs, this situation presents a critical risk. The concentration of events on the careers portal suggests that sensitive employee and potentially client information related to recruitment processes may be compromised. Prioritization should focus on investigating the database dumps and combolist sources to understand the full scope of compromised data, assessing the impact on the careers portal and associated systems, and implementing immediate remediation to secure these assets and prevent further data exfiltration. The presence of infostealer malware necessitates a thorough endpoint and network scan to detect and remove any active infections.