fetlife.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting approximately 184,711 clients and 144 employees of fetlife.com, spanning from July 2025 to June 2026. The primary drivers of this exposure are historical data breaches, accounting for 80.1% of events, and active infostealer logs, representing 19.9%. The data breaches are predominantly sourced from "Combolist sources," suggesting credential stuffing or similar attacks leveraging previously compromised credentials. Infostealer activity is linked to malware families such as LummaC2, Acreed, and Rhadamanthys, which are known for exfiltrating sensitive information. The targeted services are primarily related to user authentication and signup on the fetlife.com domain, indicating a focus on account takeover and credential harvesting. Given the high volume of client data breaches and the active presence of infostealers targeting authentication mechanisms, this incident poses a critical risk to user privacy and account security. The prevalence of "Combolist sources" in leak repositories points to a reliance on previously compromised credentials, necessitating immediate credential reset campaigns for affected users and enhanced monitoring for anomalous login activity. Remediation efforts should focus on strengthening authentication controls, implementing multi-factor authentication where possible, and actively hunting for indicators of compromise related to the identified infostealer families across the user base. The geographical breakdown shows a concentration of affected users in the United States, Canada, and the United Kingdom, which should inform targeted communication and support efforts.