news24.com Domain Breach Exposure Report

The telemetry indicates a significant exposure of client data, with 6102 historical data breaches and 1744 active infostealer logs observed over the reporting period. The majority of these events are linked to "Combolist sources" (99.8%), suggesting compromised credential lists are a primary vector. Malware families such as LummaC2 (22.9%), Redline (10.1%), and Rhadamanthys (8.1%) are prevalent, indicating active credential harvesting. The targeted services include authentication endpoints like "/auth/signin" and "/auth/signup" on news24.com, and the domain itself, suggesting a focus on user credentials. The primary geography affected is South Africa (924 instances). The timeline shows a notable increase in client-related events from March 2026 onwards, coinciding with a rise in employee-related events as well. The high volume of data breaches and infostealer activity, coupled with the targeting of authentication services, presents a critical risk of account compromise and potential further downstream impacts. The prevalence of common infostealer malware families points to a widespread threat landscape. Prioritization should focus on immediate remediation of identified vulnerabilities, enhanced monitoring of authentication endpoints, and user education regarding credential security. Given the nature of the data and the domain, the most appropriate industry sector is Retail & E-commerce.