merck.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting merck.com, with a risk score of 100. The primary concern stems from 154,360 historical data breaches, accounting for 98% of the total events. Additionally, 3,164 active infostealer logs were observed, representing 2% of events. The timeline shows a substantial surge in employee-related events in January 2026, with 79,140 instances, and a consistent rise in client-related events from September 2025 through June 2026. Malware analysis reveals Redline as the dominant family (58.1%), followed by LummaC2 (9.3%) and Vidar (8.1%). Targeted services include merck.com and guest-auth.merck.com, with geographical data showing the United States and India as primary locations for observed activity. The high volume of historical data breaches and active infostealer logs, coupled with the prevalence of infostealer malware like Redline, suggests a critical risk of ongoing credential compromise and potential sensitive data exfiltration. The concentration of events on authentication services like guest-auth.merck.com and pingfedpassive.merck.com indicates a potential focus on gaining unauthorized access to internal systems. Remediation efforts should prioritize a comprehensive review of past data breach incidents, enhanced monitoring for infostealer activity, and immediate security hardening of authentication infrastructure.