kenvue.com Domain Breach Exposure Report

The telemetry indicates a significant exposure of 1386 events over the period from July 2025 to June 2026, with a high risk score of 93. The majority of these events, 80.4%, are historical data breaches, and 19.6% are active infostealer logs. Notably, there were 1114 data breaches and 272 infostealer events. The timeline shows a surge in employee and client-related events, particularly in April 2026, with 397 employee and 69 client events. Malware families such as Millenium, LummaC2, and Rhadamanthys are prevalent, suggesting active compromise campaigns. The data also points to targeted attacks against the kenvue.com single sign-on (SSO) services, with 60 events related to `https://sso.kenvue.com/idp/eyJ2c2lkIjoiaHR0cDpcL1wva2VudnVlLmNvbVwvUGluZ0ZlZGVyYXRlIn0/prp.wsf`. The high volume of data breaches and infostealer activity, coupled with the targeting of SSO infrastructure, presents a critical risk. The prevalence of infostealer malware like LummaC2 and Rhadamanthys indicates a strong likelihood of credential harvesting and potential unauthorized access to sensitive systems. The geographical distribution shows a concentration of events originating from Pakistan, India, and Egypt, which may indicate the origin of attacks or compromised user locations. Remediation efforts should focus on securing SSO endpoints, enhancing endpoint detection and response for infostealer malware, and investigating the root causes of the historical data breaches.