lennar.com Domain Breach Exposure Report

The telemetry indicates a significant exposure of lennar.com, with 49,462 historical data breaches and 2,561 active infostealer logs observed over the reporting period. The majority of the infostealer activity is attributed to the Redline malware family, suggesting a widespread compromise targeting credentials. The data breaches are largely sourced from "Combolist sources" and "Database dumps," indicating a high likelihood of credential stuffing attacks against employee and client accounts. The timeline shows a surge in employee and client-related events in September 2025 and January 2026, correlating with potential periods of increased exploitation. Targeted services include lennar.com login pages and authentication services, indicating a focus on gaining access to user accounts. The prevalence of 32-bit Windows operating systems in the telemetry is notable, potentially indicating legacy systems that are more vulnerable. Given the high volume of data breaches and active infostealer logs, particularly those leveraging credential stuffing techniques, the risk to lennar.com is critical. The primary remediation focus should be on immediate credential reset for all affected employees and clients, enhanced multi-factor authentication deployment, and a thorough review of authentication and access controls for all lennar.com domains and associated services. Additionally, an investigation into the root cause of the historical data breaches and the active infostealer infections is paramount to prevent future occurrences.