pbs.org Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting pbs.org, with 22,481 historical data breaches and 3,121 active infostealer logs observed over the period from July 2025 to June 2026. The majority of these events are linked to "Combolist sources" (90.7%) and "Database dumps" (9.3%), suggesting compromised credentials are a primary vector. Malware families such as Redline, Rhadamanthys, and LummaC2 are prevalent, often associated with credential theft. The targeted services primarily include account login and registration endpoints, indicating a focus on user account compromise. The timeline shows a surge in employee and client-related events in January 2026, with subsequent spikes in client events in March and April 2026. The geographical distribution is heavily concentrated in the United States. Given the high volume of data breaches and active infostealer logs, coupled with the prevalence of credential-harvesting malware, this situation poses a critical risk to both employee and client data. The focus should be on immediate credential rotation for all affected users, particularly those associated with the "account.pbs.org" service. A thorough investigation into the source of the combolists and database dumps is crucial to understand the initial compromise and prevent recurrence. Implementing enhanced multi-factor authentication and reviewing access controls for critical services should be prioritized.