firstcitizens.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting firstcitizens.com, with a total of 31,900 events recorded over the period from July 2025 to June 2026. The majority of these events, 86.9%, are classified as historical data breaches, totaling 27,716 incidents. Additionally, 4,184 events are identified as active infostealer logs, representing 13.1% of the total. The data suggests a substantial risk to both employees and clients, with 14,568 employee-related events and 17,332 client-related events. The timeline shows a sharp increase in employee-related events in January 2026, with 9,892 incidents, and a consistent high volume of client-related events throughout the period, particularly in September 2025 (1,511) and March 2026 (4,255). Malware families such as Blank Grabber, Rhadamanthys, and LummaC2 are prevalent, often associated with infostealer activities. The exposure is heavily concentrated in the United States, with 1,767 incidents, and also shows activity in Argentina, India, and Nigeria. Leak repositories indicate a significant presence of combolist sources (50.7%) and database dumps (49.3%), suggesting credential stuffing or direct data exfiltration as primary attack vectors. Given the high volume of historical data breaches and active infostealer logs, coupled with the direct targeting of digital banking services, this situation presents a critical risk. The prevalence of infostealer malware and the presence of combolists and database dumps in leak repositories strongly suggest that compromised credentials are being actively exploited. Prioritization should focus on immediate incident response to contain ongoing infostealer activity, comprehensive credential hygiene for both employees and clients, and a thorough investigation into the root cause of the historical data breaches to prevent recurrence. The primary remediation focus should be on securing authentication mechanisms, enhancing endpoint security to detect and remove infostealer malware, and implementing robust data loss prevention strategies.