etrade.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting etrade.com, with a total of 137,330 recorded events over the period from July 2025 to June 2026. The majority of these events, 83.8%, are classified as historical data breaches, totaling 115,111 incidents. Additionally, 16.2% of events, or 22,219 incidents, are identified as active infostealer logs. The data shows a sharp increase in employee and client-related events in January 2026, with 11,685 employee events and 15,345 client events recorded in that month. The most frequently observed malware families associated with these events are Rhadamanthys, LummaC2, and Redline, suggesting a coordinated effort by threat actors utilizing common infostealer tools. The primary targeted services are login pages for etrade.com and express.etrade.com, indicating a focus on credential harvesting. The majority of the exposure originates from the United States, with other affected geographies including India and South Africa. The data also indicates that 88.1% of the leak repository classification stems from combolist sources, suggesting a reliance on previously compromised credential lists. The high volume of historical data breaches and active infostealer logs, coupled with the targeting of critical login services, presents a critical risk to the organization and its users. The prevalence of known infostealer malware families like Rhadamanthys, LummaC2, and Redline points to a sophisticated and ongoing threat. The concentration of events in January 2026 warrants immediate investigation into potential triggers or successful exploitation campaigns during that period. Remediation efforts should focus on enhancing credential security, implementing robust multi-factor authentication across all services, and conducting thorough security audits of systems handling sensitive client and employee data. Continuous monitoring for infostealer activity and proactive threat hunting are also recommended.