jpmorganchase.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting jpmorganchase.com, with 82,327 total events recorded between July 2025 and June 2026. The majority of these events, 95.4%, are classified as historical data breaches, affecting 78,552 instances. Additionally, 4.6% of events, totaling 3,775, are identified as active infostealer logs. The data suggests a substantial compromise of employee and client information, with 68,912 employee-related events and 13,415 client-related events. The timeline shows a sharp increase in employee-related events in January 2026, with 39,537 occurrences, and a notable rise in client-related events in March 2026, with 3,495 occurrences. Malware analysis reveals Redline as the predominant family, accounting for 52.2% of identified malware, followed by LummaC2 at 9.9% and Rhadamanthys at 7%. Targeted services include various authentication portals, such as smportal.jpmorganchase.com and ida.jpmorganchase.com, suggesting potential credential harvesting or unauthorized access attempts. The data originates primarily from the United States, Netherlands, and Germany. Leak repository analysis indicates that 53.9% of exposed data comes from combolist sources and 46.1% from database dumps.