ocn.ne.jp Domain Breach Exposure Report

The telemetry indicates a significant exposure event affecting the domain ocn.ne.jp, with a total of 55,926 events recorded between July 2025 and June 2026. The majority of these events, 93.3%, are classified as historical data breaches, totaling 52,198 incidents. Additionally, 6.7% of events, or 3,728 incidents, are identified as active infostealer logs. The data breaches appear to be primarily sourced from "Combolist sources" (61.1%) and "Database dumps" (38.9%). Infostealer activity is dominated by malware families such as Redline (15.7%), Rhadamanthys (11.8%), and LummaC2 (10.9%). Targeted services are predominantly related to OCN login portals, with "https://login.ocn.ne.jp" being the most frequently observed. The exposure primarily impacts clients (53,393) and employees (2,533). Given the high volume of historical data breaches and active infostealer logs, this situation presents a critical risk. The prevalence of infostealer malware targeting login portals suggests a high likelihood of credential compromise, potentially leading to further unauthorized access and data exfiltration. Remediation efforts should focus on immediate credential resets for all affected employees and clients, enhanced monitoring of login activity for suspicious patterns, and a thorough review of data security practices to prevent future data breaches, particularly those originating from compromised credentials or database leaks.