jll.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event for jll.com, with a risk score of 100. The primary concern stems from 44,821 historical data breaches and 1,655 active infostealer logs, impacting 36,507 employees and 9,969 clients. Malware families such as LummaC2, Rhadamanthys, and Redline are prevalent, suggesting a focus on credential harvesting. The timeline shows a notable spike in employee and client-related events in January 2026, coinciding with a surge in data breaches. Targeted services include authentication endpoints like ap.jll.com and am.jll.com, as well as Okta and Microsoft services, indicating potential compromise of access controls. Given the high volume of data breaches and active infostealer activity, this situation poses a critical risk to the organization. The prevalence of credential-stealing malware targeting authentication services like Okta and Microsoft, coupled with the extensive historical data breach data, suggests a high likelihood of ongoing unauthorized access and potential for further compromise. Remediation should prioritize securing authentication mechanisms, investigating the root cause of the data breaches, and actively hunting for active infostealer infections across the affected employee and client base, with a particular focus on compromised credentials originating from India and the United States.