monday.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting monday.com, with over 438,000 historical data breaches and nearly 90,000 active infostealer logs observed within the reporting period. The majority of these events are linked to combolist sources, suggesting credential stuffing or account takeover attempts. The timeline shows a notable increase in employee-related events in early 2026, particularly in January, coinciding with a surge in client-related events in March. Malware families like LummaC2, Redline, and Rhadamanthys are prevalent, indicating active credential harvesting operations. Given the high volume of data breaches and infostealer activity, coupled with the prevalence of credential-harvesting malware targeting authentication services, this incident poses a critical risk. The focus should be on immediate credential hygiene, including mandatory password resets for all users, enabling multi-factor authentication across the platform, and investigating the source of the combolist data. Prioritizing remediation efforts on the targeted authentication services and analyzing the compromised user accounts will be crucial to mitigating further impact.