gofundme.com Domain Breach Exposure Report

The telemetry indicates a significant exposure impacting approximately 534,963 clients and 555 employees of gofundme.com. The primary threat vectors observed are historical data breaches, accounting for 87.4% of events, and active infostealer logs, representing 12.6%. Malware families such as LummaC2, Rhadamanthys, and Redline are prevalent in infostealer activity. The majority of data breach evidence originates from "Combolist sources," suggesting credential stuffing or account takeover attempts. Geographically, the United States is the most affected country, followed by the United Kingdom and Canada. The timeline shows a surge in client-related events in March 2026, coinciding with a rise in employee-related events in January 2026. Given the high volume of client data breaches and active infostealer logs targeting gofundme.com and its associated sign-up and sign-in pages, this exposure presents a critical risk. The prevalence of infostealers like LummaC2 and Redline, which are known to exfiltrate credentials and sensitive information, amplifies the potential for further account compromises and financial fraud. Remediation efforts should focus on enhancing credential security, implementing robust multi-factor authentication across all platforms, and conducting thorough security audits of user account management systems. Prioritizing the investigation of the "Combolist sources" is crucial to understanding the initial compromise vector for the historical data breaches.