paloaltonetworks.com Domain Breach Exposure Report

The telemetry indicates a significant exposure of sensitive information, with 48,331 historical data breaches and 9,123 active infostealer logs detected. The majority of the data breaches are attributed to "Combolist sources" (72.4%) and "Database dumps" (27.6%), suggesting compromised credentials. Infostealer activity is dominated by LummaC2 (15.5%), Rhadamanthys (11.6%), and Redline (10.7%) malware families. The affected services primarily include login portals for paloaltonetworks.com, with a notable mention of Okta and Paloalto VPN. Geographically, India, South Africa, and the United States show the highest incidence of these events. The timeline shows a sharp increase in employee and client-related events in January 2026, coinciding with a surge in data breaches and infostealer activity. The high risk score of 100 and the critical asset booster flag indicate an urgent need for remediation. The prevalence of credential stuffing and infostealer malware targeting authentication services necessitates immediate review and strengthening of access controls, including multi-factor authentication enforcement and credential hygiene practices for both employees and clients. Prioritization should focus on mitigating the impact of compromised credentials and preventing further data exfiltration.