globalpayments.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting Global Payments, with 347 historical data breaches and 20 active infostealer logs observed over the past year. The majority of these events (94.6%) are attributed to historical data breaches, while the remaining 5.4% are linked to active infostealer activity. A notable surge in employee-related events occurred in January 2026, with 229 instances, suggesting a potential compromise or widespread credential stuffing. Malware families like LummaC2, Vidar, and Redline are present, and targeted services include the "com.globalpayments.atom" Android application and the "globalpayments.com/login" web portal. Data appears to originate from "Database dumps" and "Combolist sources", with a geographical focus on Czechia, Romania, and Slovakia. Given the high volume of historical data breaches and the presence of active infostealer logs, this situation presents a critical risk. The spike in employee-related events in January 2026 warrants immediate investigation to determine the root cause and scope of compromise. Remediation efforts should focus on credential hygiene, including mandatory password resets for affected employees and clients, enhanced monitoring for suspicious activity on the "com.globalpayments.atom" application and "globalpayments.com/login" portal, and a thorough review of data security practices related to database dumps and combolists.