hola.com Domain Breach Exposure Report

The domain hola.com has experienced a high volume of data breaches and infostealer activity over the past year, with 6,092 data breach events and 797 infostealer events. The majority of these events are linked to "Combolist sources" (82.9%) and "Database dumps" (17.1%), suggesting a significant exposure of credential data. Malware families such as LummaC2, Redline, and Rhadamanthys are prevalent, indicating active compromise and data exfiltration attempts. The timeline shows a surge in employee and client-related events, particularly in September 2025 and March 2026, correlating with periods of high breach and infostealer activity. Targeted services include authentication endpoints like auth.hola.com and micuenta.hola.com, indicating that login credentials are a primary target. Given the high risk score of 100 and the extensive data breach and infostealer events, this exposure poses a critical threat. The prevalence of credential stuffing and data exfiltration malware targeting authentication services necessitates immediate attention. Prioritize the investigation and remediation of compromised credentials, review access controls for authentication services, and enhance monitoring for suspicious login activity. The geographic distribution indicates a focus on Spain, Mexico, and Colombia, which should inform targeted incident response efforts.