nu.nl Domain Breach Exposure Report

The telemetry indicates a significant exposure of 6,007 client accounts and 246 employee accounts, primarily driven by 5,590 historical data breaches and 663 active infostealer logs. The data breaches are predominantly sourced from "Combolist sources" (98.2%), suggesting credential stuffing or account takeover attempts. Infostealer activity is led by LummaC2 (25.2%), Redline (19.6%), and Rhadamanthys (8%), which are known to exfiltrate credentials and sensitive information. The exposure period spans from July 2025 to June 2026, with notable spikes in client account exposure during September 2025 and March-April 2026. The primary affected geography is the Netherlands. Given the high volume of historical data breaches and active infostealer logs targeting client and employee accounts, this situation presents a critical risk. The prevalence of LummaC2 and Redline malware families indicates a direct threat to credential integrity and potential for further compromise. Remediation should focus on immediate credential rotation for all affected employee and client accounts, enhanced monitoring for suspicious login activity, and implementing robust multi-factor authentication across all services. A thorough investigation into the root cause of the data breaches and infostealer infections is also paramount.