kbr.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting kbr.com, with 29,896 historical data breaches and 270 active infostealer logs observed between July 2025 and June 2026. The majority of the exposure, 74.9%, originates from database dumps, with the remainder from combolist sources. Malware analysis reveals Redline, Rhadamanthys, and Acreed as prevalent infostealer families, suggesting a focus on credential harvesting. The timeline shows a sharp increase in employee and client-related events in September 2025 and January 2026, correlating with potential large-scale credential compromise. Targeted services include authentication portals and SAP work environments, indicating a risk to sensitive internal and client-facing systems. The high volume of historical data breaches and active infostealer logs, coupled with the prevalence of credential-harvesting malware, elevates the risk to kbr.com. The exposure spans multiple geographies, with the United States, Saudi Arabia, and Iraq being most affected. Remediation efforts should prioritize securing authentication mechanisms, reviewing access logs for anomalous activity, and implementing enhanced endpoint protection to detect and mitigate infostealer malware. Given the nature of the data breaches and the services targeted, a comprehensive review of data handling policies and client-facing systems is also recommended.