konga.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting konga.com, with a total of 83,617 recorded events over the period from July 2025 to June 2026. The majority of these events, 88.1%, are classified as historical data breaches, while 11.9% are active infostealer logs. The data shows a substantial number of affected clients (82,662) and employees (955). The timeline reveals a peak in client-related events in March 2026, with a corresponding increase in employee events. The primary malware families associated with these events are LummaC2, Redline, and Rhadamanthys, all known for their credential-stealing capabilities. The exposure is predominantly linked to "Combolist sources" within leak repositories, suggesting compromised credentials are a major vector. Given the high volume of data breaches and infostealer activity, coupled with the targeting of client and employee accounts on konga.com, this situation presents a critical risk. The prevalence of credential-stealing malware and the origin of the data from combolists indicate a high likelihood of account takeovers and further downstream compromise. Prioritization should focus on immediate credential reset campaigns for both employees and clients, enhanced monitoring for suspicious login activity, and a thorough investigation into the root cause of the data breaches and infostealer infections, particularly concerning the identified malware families and their distribution channels.