kyndryl.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting kyndryl.com, with a total of 15,959 recorded events over the period of July 2025 to June 2026. The majority of these events, 13,633 (85.4%), are historical data breaches, while 2,326 (14.6%) are active infostealer logs. A substantial number of employee credentials, 15,817, and 142 client credentials have been compromised. The most prevalent malware families associated with these events are Rhadamanthys (21.2%), LummaC2 (17.8%), and Acreed (9.9%), suggesting a focus on credential harvesting. The data also shows a high concentration of compromised credentials originating from India (587) and Argentina (279), and targeting services like Microsoft (11%) and Okta (0.6%). Given the high volume of historical data breaches and active infostealer logs, coupled with the compromise of a large number of employee and client credentials, this situation presents a critical risk. The prevalence of infostealer malware targeting credential harvesting indicates a direct threat to ongoing operations and data confidentiality. Prioritization should focus on immediate remediation of compromised accounts, enhanced monitoring for suspicious activity, and a review of authentication and access controls, particularly for services like Microsoft and Okta. The timeline shows a peak in employee credential compromises in April 2026, suggesting a sustained or escalating threat.