natwest.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting natwest.com, with a total of 41,651 recorded events over the period from July 2025 to June 2026. A substantial 88.7% of these events are classified as historical data breaches, totaling 36,937 incidents, while 11.3% are active infostealer logs, amounting to 4,714 incidents. The data suggests a concentrated period of employee-related events in January 2026, with 7,490 incidents, and a notable surge in client-related events in March 2026, with 8,471 incidents. The primary sources of exposure appear to be combolist sources (78.1%) and database dumps (21.9%), with malware families such as Rhadamanthys, LummaC2, and Redline being prevalent. The high volume of historical data breaches and active infostealer logs, coupled with the targeting of services like openaccount.natwest.com and digidocs.natwest.com, indicates a critical risk to both employee and client data. The prevalence of infostealer malware suggests ongoing attempts to exfiltrate credentials and sensitive information. Prioritization should focus on immediate remediation of identified vulnerabilities, enhanced monitoring for credential stuffing attacks originating from combolists, and comprehensive incident response to mitigate the impact of ongoing infostealer activity. The primary geographical origin of the telemetry is the United Kingdom.