openai.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting OpenAI, primarily driven by a massive volume of historical data breaches (67.4%) and active infostealer logs (32.6%) over the period of July 2025 to June 2026. The data breaches affected approximately 5.7 million client records, while infostealer activity targeted over 2.7 million client records. Employee exposure was comparatively lower, with 468 records compromised. The primary malware families associated with these events are LummaC2, Rhadamanthys, and Redline, all known for credential theft. The targeted services are predominantly authentication endpoints, including signup and login pages hosted on auth0.openai.com and auth.openai.com, suggesting a focus on account takeover. Geographically, India, Brazil, and Pakistan show the highest incidence of exposure. This incident presents a high-risk scenario due to the sheer volume of compromised client data and the nature of the infostealer activity, which could lead to widespread account takeovers and further downstream impacts. The prevalence of credential stuffing and phishing-related malware families targeting authentication services necessitates immediate attention to access controls, credential management, and user awareness training. Prioritization should focus on mitigating further data exfiltration, investigating the root cause of the historical data breaches, and enhancing the security posture of authentication infrastructure, particularly for regions with high reported exposure.