finn.no Domain Breach Exposure Report

The domain finn.no has experienced a high volume of security events over the past year, with a significant portion attributed to historical data breaches (63.2%) and active infostealer logs (36.8%). A total of 5405 events were recorded, impacting 467 employees and 4938 clients. The timeline shows a notable increase in client-related events from September 2025 onwards, peaking in April 2026. Malware families such as Rhadamanthys, LummaC2, and Redline are prevalent, suggesting ongoing credential harvesting and data exfiltration attempts. The majority of data exposure originates from "Combolist sources" (94.9%), indicating compromised credential reuse across services. Given the high risk score of 89 and the substantial number of client and employee events linked to infostealer activity and data breaches, this exposure presents a critical risk. The prevalence of infostealers targeting credentials, coupled with the reliance on combolist sources, suggests a high likelihood of account compromise and potential financial or identity fraud impacting users. Prioritization should focus on immediate remediation of exposed credentials, enhanced monitoring for unauthorized access, and user education regarding phishing and credential security, particularly for the Norwegian user base which constitutes the largest geographical segment.