medallia.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting Medallia's clients and employees, with 13,405 historical data breaches and 1,512 active infostealer logs observed over the reporting period. The majority of these events, 89.9%, are attributed to historical data breaches, while 10.1% are active infostealer logs. Malware families such as LummaC2, Redline, and Rhadamanthys are prevalent, suggesting potential credential harvesting and data exfiltration activities. The targeted services include various subdomains of medallia.com, with a notable concentration on coppel.medallia.com and samsungus.medallia.com, primarily affecting users in Mexico and the United States. The high volume of historical data breaches and active infostealer logs, coupled with the prevalence of infostealer malware, elevates the risk to a critical level. The data suggests a broad impact across both employee and client data, with a peak in observed events during January 2026. Remediation efforts should focus on securing credentials, enhancing endpoint security to detect and prevent infostealer malware, and investigating the root cause of the historical data breaches to prevent recurrence. Prioritizing the protection of client data and employee PII is paramount given the nature and scale of the observed exposures.