elevancehealth.com Domain Breach Exposure Report

The telemetry indicates a significant exposure impacting elevancehealth.com, with 1146 total events observed over the period from July 2025 to June 2026. A substantial portion of these events, 985, are classified as historical data breaches, while 161 are active infostealer logs. The data suggests a high volume of client-related events (505) alongside employee-related events (641), indicating a broad impact. Malware families such as Rhadamanthys, LummaC2, Redline, and Vidar are frequently observed, suggesting active credential harvesting and data exfiltration attempts. The primary targeted services include authentication endpoints like `pulse.elevancehealth.com` and `securefed.elevancehealth.com`, which are critical for both employee and client access. The high risk score of 90, driven by the prevalence of historical data breaches and active infostealer activity, necessitates immediate attention. The observed malware families are known for stealing credentials and sensitive information, posing a direct threat to data integrity and confidentiality. Remediation efforts should focus on strengthening authentication mechanisms, reviewing access logs for suspicious activity related to the targeted services, and conducting thorough security audits to identify and mitigate the root causes of the data breaches and infostealer infections. Prioritizing the investigation of the 985 historical data breaches and the 161 active infostealer logs is crucial for understanding the full scope of the compromise and preventing further exploitation.