nih.gov Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting nih.gov, with 95,372 total events recorded between July 2025 and June 2026. The majority of these events, 87,427 (91.7%), are classified as historical data breaches, while 7,945 (8.3%) are active infostealer logs. The data breach events suggest a large-scale compromise of sensitive information, potentially affecting a substantial number of employees and clients, as evidenced by the 24,251 employee and 71,121 client events. The timeline shows a notable surge in employee-related events in January 2026, with 17,987 occurrences, and a peak in client-related events in March 2026, with 18,158 occurrences. The presence of infostealer logs, particularly LummaC2, Redline, and Acreed malware families, indicates ongoing attempts to exfiltrate credentials and sensitive data. The leak repository classification shows a high percentage of data originating from combolist sources (75.7%) and database dumps (24.3%), suggesting credential stuffing or data aggregation from previous breaches. Given the nature of the data breaches and the active infostealer logs, this exposure poses a critical risk to NIH.gov. The primary focus for remediation should be on identifying the root cause of the historical data breaches, enhancing data security measures to prevent future breaches, and actively monitoring for and mitigating the impact of ongoing infostealer activity. The prevalence of LummaC2 and Redline malware families suggests a need for enhanced endpoint detection and response capabilities, as well as user education on phishing and credential security. The targeted services, primarily related to NCBI, highlight specific areas requiring immediate security review and hardening.