kkr.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting kkr.com, with 5,721 historical data breaches and 159 active infostealer logs observed over the reporting period. The majority of the exposure, 97.3%, stems from historical data breaches, while 2.7% is attributed to active infostealer activity. Employee accounts are the most affected category, with 5,672 instances, followed by client accounts with 208 instances. The timeline shows a substantial spike in employee-related events in January 2026, with 2,760 occurrences, and a consistent increase in both employee and client events from September 2025 through June 2026. Malware families associated with this activity include LummaC2, Rhadamanthys, and Redline, suggesting a sophisticated threat actor. The primary targeted services are related to authentication and single sign-on, including kkr.com, saml.sso.kkr.com, and login.identity.kkr.com, indicating a focus on credential harvesting and account compromise. Given the high volume of historical data breaches and active infostealer logs, coupled with the targeting of critical authentication services and the presence of common infostealer malware, this event poses a high risk. The exposure of employee and client data, particularly the surge in January 2026, necessitates immediate investigation and remediation. Focus should be placed on securing authentication mechanisms, reviewing access logs for unauthorized activity, and enhancing endpoint security to detect and prevent infostealer infections. The prevalence of database dumps and combolist sources in leak repositories suggests that compromised credentials may be leveraged in further attacks.