ifixit.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event affecting 72,172 clients and 335 employees, primarily driven by 64,911 historical data breaches and 7,596 active infostealer logs. The data breaches are overwhelmingly sourced from "Combolist sources," suggesting compromised credentials. Infostealer activity is dominated by LummaC2, Redline, and Rhadamanthys malware families, which are known for exfiltrating credentials and sensitive information. The timeline shows a surge in client-related events in September 2025 and January-June 2026, with employee exposure also peaking in January 2026. The targeted services are predominantly related to the ifixit.com domain, including login and registration pages, indicating a focus on account compromise. Given the high volume of historical data breaches and active infostealer logs, the priority is to address credential stuffing and account takeover risks. Remediation should focus on enforcing strong, unique passwords, implementing multi-factor authentication across all client and employee accounts, and actively monitoring for suspicious login activity originating from the United States and Brazil, where the majority of affected users are located. A thorough review of the ifixit.com login and registration processes for vulnerabilities is also recommended.