mlb.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting mlb.com, with a total of 138,818 recorded events over the period from July 2025 to June 2026. The majority of these events, 86.1%, are classified as historical data breaches, totaling 119,540 incidents. Additionally, 19,278 events, representing 13.9% of the total, are identified as active infostealer logs. The data suggests a substantial compromise affecting 128,747 clients and 10,071 employees. The timeline shows a notable surge in employee-related events in January 2026, with 6,678 incidents, and a significant increase in client events in March 2026, with 33,515 incidents. Malware families such as LummaC2, Redline, and Rhadamanthys are frequently observed. The primary targeted services are login pages, including https://www.mlb.com/login and mlb.com/login, with the United States being the most affected country. The leak repository classification indicates that 93.3% of the data originates from combolist sources, suggesting credential stuffing or similar attacks leveraging compromised credential lists. Given the high volume of data breaches and active infostealer logs, coupled with the large number of affected clients and employees, this incident poses a critical risk. The prevalence of infostealer malware families targeting login credentials indicates a strong likelihood of ongoing credential compromise and potential account takeovers. The reliance on combolist sources for leaked data further supports the hypothesis of credential-based attacks. Prioritization should focus on immediate incident response, including credential reset for all affected users, enhanced monitoring of login activities, and a thorough review of authentication and authorization mechanisms. Remediation efforts should also address the identified malware families and strengthen defenses against credential stuffing and infostealer threats.