office.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting over 212,000 entities, primarily clients (207,904) and employees (4,639), over a 12-month period ending June 2026. The exposure is dominated by historical data breaches (76.7%) and active infostealer logs (23.3%). Key malware families identified include LummaC2 (45.9%) and Redline (4.8%), suggesting credential harvesting and data exfiltration. The targeted services are predominantly Microsoft Office 365 portals, with the United States, India, and Brazil being the most affected geographies. The data originates from combolist sources and database dumps, indicating compromised credentials. Given the high volume of data breaches and active infostealer activity targeting employee and client credentials for Microsoft Office 365 services, this event poses a critical risk. The prevalence of LummaC2 and Redline malware points to sophisticated credential harvesting operations. Prioritization should focus on immediate credential reset campaigns for all affected employees and clients, enhanced multi-factor authentication enforcement, and thorough security awareness training. Continuous monitoring for anomalous login activity and further data exfiltration attempts is crucial.