irs.gov Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting the IRS.gov domain, with a high volume of historical data breaches and active infostealer logs. The data suggests a substantial risk to both employee and client information, with over 194,000 historical data breaches and nearly 40,000 active infostealer logs recorded. The timeline shows a sharp increase in employee and client-related events in January 2026, coinciding with a surge in data breach and infostealer activity. The primary threat vectors appear to be infostealer malware families such as Redline, Rhadamanthys, and LummaC2, which are commonly associated with credential harvesting. The targeted services are primarily related to IRS.gov's online portals for status checks and account registration, indicating a potential focus on compromising user credentials for these services. The leak repository classification points to combolist sources and database dumps as the origin of the exposed data, suggesting a large-scale credential stuffing or data aggregation attack.