noaa.gov Domain Breach Exposure Report

The domain noaa.gov experienced a significant number of events between July 2025 and June 2026, with a total of 30,333 recorded. The vast majority of these events, 97%, were historical data breaches, totaling 29,432 incidents. Additionally, 901 active infostealer logs were observed, representing 3% of the total events. Employee-related events peaked in January 2026 with 11,280 occurrences, while client-related events saw a surge in September 2025 with 2,066 incidents. Malware analysis indicates a prevalence of infostealers such as LummaC2 (17.2%), Rhadamanthys (10.9%), and Acreed (10.9%). The data suggests a high volume of historical data exposure and ongoing threats from credential-harvesting malware targeting employee and client data. The primary focus for remediation should be on addressing the historical data breaches and strengthening defenses against infostealer malware, particularly LummaC2, Rhadamanthys, and Acreed, to prevent further compromise of sensitive information. The telemetry indicates a high-risk environment for noaa.gov, with a risk score of 100. The overwhelming number of historical data breaches suggests a long-term exposure of sensitive information, potentially impacting a large number of employees and clients. The presence of active infostealer logs, coupled with common malware families known for credential theft, indicates an immediate threat to ongoing operations and data integrity. Prioritization should be given to investigating the root causes of the historical data breaches, implementing robust data loss prevention measures, and enhancing endpoint security to detect and mitigate infostealer activity. The geographical breakdown shows a concentration of events originating from the United States, Canada, and India, which may inform targeted threat hunting and incident response efforts.