google.co.nz Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting 205 employees and 407 clients, primarily driven by 502 historical data breaches and 110 active infostealer logs over the period of July 2025 to June 2026. The data breaches and infostealer activity are strongly associated with credential stuffing attacks originating from combolist sources, with malware families like Redline and LummaC2 being prevalent. The targeted services are predominantly related to google.co.nz, suggesting a potential phishing or credential harvesting campaign aimed at users of this domain. The operating systems most affected are Windows 11 and Windows 10 Pro x64, with a notable presence of older Windows Server versions, indicating a broad range of potential vulnerabilities. Given the high volume of historical data breaches and active infostealer logs, coupled with the targeting of a widely used domain like google.co.nz, this incident presents a critical risk. The prevalence of Redline and LummaC2 suggests a high likelihood of credential theft and potential further compromise. Prioritization should focus on immediate credential reset for all affected employees and clients, enhanced monitoring for suspicious activity on google.co.nz related accounts, and a review of security controls to prevent future credential stuffing and infostealer infections, particularly on Windows 11 and older Windows Server environments.