duke-energy.com Domain Breach Exposure Report

The telemetry indicates a significant historical data breach event affecting over 159,000 records, alongside active infostealer logs impacting over 17,000 instances. The majority of the data breach events are attributed to "Combolist sources" and "Database dumps," suggesting compromised credentials. The infostealer activity is dominated by malware families such as Redline, Rhadamanthys, and LummaC2, which are known for exfiltrating sensitive information. The timeline shows a surge in employee and client data exposure during January 2026, with a notable increase in client-related events in March 2026. The targeted services are primarily related to the "duke-energy.com" domain, including its sign-in portals, indicating a focus on account compromise. The high volume of historical data breaches and active infostealer logs, coupled with the targeting of authentication services, presents a critical risk of further credential compromise and potential unauthorized access to sensitive customer and employee data. The prevalence of common infostealer malware families suggests a broad attack vector. Prioritization should focus on immediate remediation of identified vulnerabilities, credential reset campaigns for affected users, and enhanced monitoring for suspicious login activity on "duke-energy.com" services. The primary geographic origin of the observed activity appears to be the United States.