internationalpaper.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting internationalpaper.com, with 10,146 total events recorded between July 2025 and June 2026. The majority of these events, 9,953, are classified as historical data breaches, with an additional 193 events identified as active infostealer logs. A substantial portion of the data breaches, 7,994, are linked to employee credentials, and 2,152 are associated with client credentials. Malware analysis reveals Redline, Rhadamanthys, and LummaC2 as the most prevalent infostealer families. The targeted services primarily involve the jobs portal, including login and application pages, suggesting a potential focus on recruitment-related data. Geographically, the United States accounts for the highest number of associated events. The data breach and infostealer activity peaked in January 2026, coinciding with a large influx of employee-related events, and again in March 2026 with a surge in client-related events. The presence of "Combolist sources" and "Database dumps" in leak repositories further corroborates the nature of the exposure. Given the high volume of historical data breaches and active infostealer logs, particularly those affecting employee and client credentials, this exposure presents a critical risk. The prevalence of common infostealer families like Redline and Rhadamanthys suggests a broad attack vector. The focus on the jobs portal indicates a potential for credential stuffing attacks or the exfiltration of personally identifiable information submitted through recruitment channels. Prioritization should be placed on immediate credential reset campaigns for affected employees and clients, enhanced monitoring of authentication systems, and a thorough review of security controls around the jobs portal and any systems handling sensitive data. Investigating the root cause of the historical data breaches and the source of the infostealer logs is crucial for long-term risk mitigation.