iff.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event affecting iff.com, with 22,449 total events recorded over the period from July 2025 to June 2026. A substantial 98% of these events are classified as historical data breaches, totaling 22,004 incidents. Additionally, 445 active infostealer logs were detected, representing 2% of the total events. The timeline shows a notable surge in employee and client-related events, particularly in January 2026 with 6,512 employee events and February 2026 with 2,141 client events. Malware analysis reveals Rhadamanthys as the most prevalent infostealer family, accounting for 37.8% of detected malware, followed by LummaC2 at 16.4%. Targeted services include various login endpoints on iff.com and mail.iff.com, suggesting credential compromise attempts. The data breach sources are predominantly combolist sources (59.9%) and database dumps (40.1%), indicating a high likelihood of credential stuffing and data exfiltration. The high volume of historical data breaches and active infostealer logs, coupled with the prevalence of credential-compromising malware, presents a critical risk to iff.com. The concentration of events in specific months, especially January and February 2026, warrants immediate investigation into the root cause and potential impact. Remediation efforts should focus on strengthening authentication mechanisms, enhancing endpoint security to detect and prevent infostealer activity, and conducting thorough security audits of identified targeted services. Given the nature of the data breaches and infostealer activity, a review of data handling policies and user access controls is also recommended.