dhs.gov Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting dhs.gov, with over 113,000 total events recorded between July 2025 and June 2026. The majority of these events, 104,904, are classified as historical data breaches, with an additional 8,706 classified as active infostealer logs. This suggests a widespread compromise of sensitive information, potentially affecting both employees and clients, as evidenced by the 54,999 employee-related events and 58,611 client-related events. The timeline shows a surge in employee-related events in January 2026 and client-related events in March 2026, indicating periods of heightened compromise. The presence of infostealer logs and the high volume of data breaches, primarily sourced from combolist sources and database dumps, point to credential stuffing and large-scale data exfiltration as primary attack vectors. The high volume of historical data breaches and active infostealer logs, coupled with a risk score of 100, signifies a critical exposure. The prevalence of malware families like Rhadamanthys, LummaC2, and Redline, commonly associated with credential theft and espionage, further elevates the risk. Remediation efforts should focus on comprehensive credential hygiene, including mandatory password resets, multi-factor authentication enforcement across all services, and enhanced monitoring for suspicious login activity. Given the nature of the compromised data and the domain, immediate attention is required to assess the full scope of the breach and mitigate further damage to individuals and national security.