Back

huntington.com Domain Breach Exposure Report

Risk Score

High Risk

Massive event volume or critical assets compromised.

AI Findings Summary

Critical

The domain huntington.com has experienced a significant number of data breaches and infostealer events between July 2025 and June 2026, totaling over 121,000 incidents. The majority of these events are classified as historical data breaches (88.3%), with active infostealer logs accounting for the remainder (11.7%). A notable surge in employee and client-related events occurred in January 2026, with employee-related events peaking at over 22,000 and client-related events at over 24,000 in March 2026. The primary malware families observed are Rhadamanthys, LummaC2, and Redline, all known for their credential-stealing capabilities. The data suggests a high risk of credential compromise and potential financial fraud targeting both employees and clients, with a substantial portion of the exposure originating from combolist sources and database dumps.

Total Events

121,353
credential exposure events

Employee Affected Events

29,950
account email domain = huntington.com

Client Affected Events

91,403
service target = huntington.com

Free Community Account

Stop stolen credentials from logging in

Own this domain? Create a free Lunar account to see full exposure data and evidence.

12-Month Events Timeline

Event volume by breach date, employee VS client

EmployeesClients
25,00016,6678,3330
peak month 24,062
Jul 25Sep 25Nov 25Jan 26Mar 26May 26Jun 26

Infostealers VS Data Breaches

Live stealer logs VS data breaches

Infostealer logs
Events14,222
Share12%
Data breaches
Events107,131
Share88%
Infostealer logs (12%)
14,222events
Data breaches (88%)
107,131events

29,950 compromised employee accounts pose an infrastructure risk, while 91,403 leaked client credentials create regulatory liability.

Antivirus Distribution

Security Tools on Infected Endpoints

Windows Defender222
Windows Defender McAfee12
ESET12
Windows Defender McAfee VirusScan6
Reason Cybersecurity4
Windows Defender Sentinel Agent2
Avast2
Windows Defender.1

Malware Families Distribution

Distribution of Active Stealer Strains

Rhadamanthys2,546
LummaC21,842
Redline1,744
Acreed1,309
Vidar706
X-Files305
Millenium243
StealC54
Remus50

Top Login URLs

Top exposed services found in the event results

  1. 1https://www.huntington.com/7,511
  2. 2https://onlinebanking.huntington.com/rol/Auth/login.aspx6,759
  3. 3huntington.com5,809
  4. 4https://onlinebanking.huntington.com4,827
  5. 5onlinebanking.huntington.com4,431
  6. 6onlinebanking.huntington.com/rol/Auth/login.aspx3,942
  7. 7huntington.com/3,894
  8. 8https://www.huntington.com3,882
  9. 9https://huntington.com3,436
  10. 10www.huntington.com/3,283

Infostealer By Geography

Shows the distribution of Infostealer-related credential exposure events across different geographic regions. The location is determined by analyzing the metadata of the infected machines associated with each event.

United States
Events7,260
Indonesia
Events422
Nigeria
Events263
India
Events73
Mexico
Events67
Canada
Events65
Netherlands
Events56
Brazil
Events47

Country Breakdown

  1. 1United States7,260
  2. 2Indonesia422
  3. 3Nigeria263
  4. 4India73
  5. 5Mexico67
  6. 6Canada65
  7. 7Netherlands56
  8. 8Brazil47

Services Classification Distribution

Blast radius - closer to core = more critical infrastructure, size = credential volume

Microsoft13

Operating System Distribution

Distribution of compromised endpoint builds

Windows 111,783
Windows 11 24H2 build 26100 (64 Bit)1,371
Windows 10 Home x64745
Windows 10647
Windows 10 22H2 build 19045 (64 Bit)605

Leak Repository Classification

Where the exposed records currently reside

0
Named breaches
79,417
Combolist pools
27,714
Unattributed dumps

Disclaimer: This report includes AI-generated content. AI can make mistakes, so verify important findings independently before taking action.