google.ca Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting approximately 30,820 employees and 2,855 clients of google.ca between July 2025 and June 2026. The primary driver of this exposure appears to be historical data breaches, accounting for 33,456 events, with an additional 219 active infostealer logs also detected. Malware families such as LummaC2, Redline, and Rhadamanthys were observed, predominantly targeting Windows 11 and Windows 10 operating systems. The data originates from various sources including combolist sources and database dumps, with notable geographic origins in Canada, Nigeria, and the United States. Given the high volume of data breaches and the presence of active infostealer logs, this situation presents a critical risk. The compromise of employee and client data, coupled with the observed malware, suggests a high likelihood of credential stuffing attacks, account takeovers, and potential financial fraud. Remediation efforts should focus on immediate credential rotation for all affected employees and clients, enhanced monitoring for suspicious login activity, and a thorough review of security configurations for services hosted on or related to google.ca. Further investigation into the specific data exfiltrated during the breaches is also recommended.