disney.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event affecting Disney.com, with over 2.6 million total events recorded between July 2025 and June 2026. The majority of these events are attributed to historical data breaches (1.4 million) and active infostealer logs (1.2 million), suggesting a persistent threat landscape. Employee and client data are both impacted, with client numbers significantly higher, particularly in August 2025 and January 2026. The primary malware families identified are Redline and LummaC2, both known for credential theft. The targeted services are predominantly related to Disney+ and Star+ Android applications, with a notable concentration of activity originating from Brazil, Argentina, and Mexico. The leak repository classification shows a heavy reliance on "Combolist sources," indicating compromised credential reuse as a likely attack vector. The high volume of data breaches and infostealer activity, coupled with the targeting of consumer-facing applications and a broad geographical spread, elevates the risk to "High." The prevalence of credential-harvesting malware like Redline and LummaC2, combined with the use of combolists, points to a focus on account takeover and potential financial fraud. Remediation efforts should prioritize strengthening authentication mechanisms for both employees and clients, enhancing endpoint security to detect and prevent infostealer malware, and actively monitoring for leaked credentials associated with Disney services, especially those originating from Latin America.