Back

henryschein.com Domain Breach Exposure Report

Risk Score

High Risk

Massive event volume or critical assets compromised.

AI Findings Summary

Critical

The telemetry indicates a significant exposure event affecting henryschein.com, with 55,404 historical data breaches and 2,630 active infostealer logs observed over the reporting period. The majority of infostealer activity is attributed to the Redline malware family, which is known for credential harvesting. Employee and client data appear to be the primary targets, with a notable increase in employee-related events in September 2025 and January 2026, and client-related events peaking in September 2025 and March-April 2026. The data suggests a high-risk environment due to the volume of historical breaches and ongoing infostealer activity, potentially compromising sensitive employee and client information.

Total Events

58,034
credential exposure events

Employee Affected Events

50,731
account email domain = henryschein.com

Client Affected Events

7,303
service target = henryschein.com

Free Community Account

Stop stolen credentials from logging in

Own this domain? Create a free Lunar account to see full exposure data and evidence.

12-Month Events Timeline

Event volume by breach date, employee VS client

EmployeesClients
20,00013,3336,6670
peak month 15,216
Jul 25Sep 25Nov 25Jan 26Mar 26May 26Jun 26

Infostealers VS Data Breaches

Live stealer logs VS data breaches

Infostealer logs
Events2,630
Share5%
Data breaches
Events55,404
Share96%
Infostealer logs (5%)
2,630events
Data breaches (96%)
55,404events

50,731 compromised employee accounts pose an infrastructure risk, while 7,303 leaked client credentials create regulatory liability.

Antivirus Distribution

Security Tools on Infected Endpoints

Windows Defender75
McAfee5
Windows Defender McAfee VirusScan4
Kaspersky2

Malware Families Distribution

Distribution of Active Stealer Strains

Redline1,825
LummaC2123
X-Files90
Rhadamanthys79
Vidar59
Acreed37
StealC19
Blank Grabber17
RisePro11

Top Login URLs

Top exposed services found in the event results

  1. 1henryschein.com1,537
  2. 2https://henryschein.com441
  3. 3https://www.henryschein.com338
  4. 4www.henryschein.com274
  5. 5https://www.henryschein.com/us-en/Profiles/Login.aspx192
  6. 6https://www.henryschein.com/171
  7. 7https://www.henryschein.com/us-en/medical/Default.aspx161
  8. 8henryschein.com/us-en/Profiles/Login.aspx118
  9. 9henryschein.com/112
  10. 10https://www.henryschein.com/us-en/medical/default.aspx111

Infostealer By Geography

Shows the distribution of Infostealer-related credential exposure events across different geographic regions. The location is determined by analyzing the metadata of the infected machines associated with each event.

United States
Events806
Netherlands
Events406
Germany
Events331
Denmark
Events195
India
Events81
United Kingdom
Events56
France
Events47
Romania
Events30

Country Breakdown

  1. 1United States806
  2. 2Netherlands406
  3. 3Germany331
  4. 4Denmark195
  5. 5India81
  6. 6United Kingdom56
  7. 7France47
  8. 8Romania30

Services Classification Distribution

Blast radius - closer to core = more critical infrastructure, size = credential volume

Microsoft209
Paloalto VPN48
Citrix44
FortiNet VPN23
Git15
Intranet15
Cisco (AnyConnect)14

Operating System Distribution

Distribution of compromised endpoint builds

Windows Server 2012 x32148
Windows 11146
Windows 8.1 x32135
Windows 7 x32124
Windows Server 2016 x32124

Leak Repository Classification

Where the exposed records currently reside

0
Named breaches
40,389
Combolist pools
15,015
Unattributed dumps

Disclaimer: This report includes AI-generated content. AI can make mistakes, so verify important findings independently before taking action.