iqvia.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting IQVIA, with 59,081 historical data breaches and 3,972 active infostealer logs observed between July 2025 and June 2026. The majority of these events, 93.7%, are attributed to historical data breaches, while 6.3% are active infostealer logs. Employee accounts are the most frequently targeted, with 53,280 instances, followed by client accounts at 9,773. The primary malware families associated with these infostealer logs are Redline (55%), LummaC2 (9.1%), and Rhadamanthys (4.9%). The data suggests a high volume of compromised credentials originating from combolist sources (72.5%) and database dumps (27.5%), with targeted services including customer portals and virtual trial platforms. The United States, Netherlands, and Germany are the most affected geographies. Given the high volume of historical data breaches and active infostealer logs, coupled with the targeting of employee and client accounts, this situation presents a critical risk. The prevalence of Redline and LummaC2 suggests a focus on credential harvesting. Remediation efforts should prioritize incident response to contain active infostealer threats, thorough credential hygiene for employees and clients, and a review of security controls for customer-facing portals and virtual trial platforms. Investigating the source of the combolist and database dump exposures is also crucial.