npr.org Domain Breach Exposure Report

The telemetry indicates a significant exposure event affecting npr.org, with 9,436 historical data breaches and 551 active infostealer logs observed over the period from July 2025 to June 2026. The majority of these events are classified as historical data breaches, with a substantial portion originating from "Combolist sources" and "Database dumps" repositories. Malware families such as Redline, LummaC2, and Rhadamanthys are frequently identified, suggesting a persistent threat landscape. The timeline shows a notable surge in employee and client-related events in January 2026, with a peak in client-related events in March 2026. The primary affected geography is the United States. Given the high volume of data breaches and the presence of infostealer activity, this situation poses a critical risk to sensitive information. The prevalence of "Combolist sources" and "Database dumps" indicates potential credential stuffing attacks or the exploitation of previously compromised data. Remediation efforts should focus on enhancing credential security, implementing robust data loss prevention measures, and conducting thorough security audits of targeted services, particularly "npr.org" and its secure subdomains. Continuous monitoring for infostealer activity and prompt incident response are crucial.