ncaa.com Domain Breach Exposure Report

The telemetry indicates a significant exposure of client data, with 8399 client records compromised, primarily through data breaches (6066 events) and infostealer activity (2522 events) over the period of July 2025 to June 2026. The majority of these breaches originate from "Combolist sources," suggesting credential stuffing or account takeover attempts. The "play.ncaa.com" and "bracketchallenge.ncaa.com" services are frequently targeted, and malware families like Rhadamanthys and LummaC2 are prevalent in the infostealer logs. The exposure primarily affects users in the United States. Given the high volume of client data breaches and the targeting of public-facing services, this poses a critical risk to the organization and its users. The prevalence of infostealers and the use of common malware families indicate a persistent threat actor. Remediation should focus on strengthening authentication mechanisms, particularly for "play.ncaa.com" and "bracketchallenge.ncaa.com," implementing robust credential breach monitoring, and enhancing endpoint security to detect and prevent infostealer malware. A thorough review of data handling practices related to client information is also recommended.