pons.com Domain Breach Exposure Report

The telemetry indicates a significant exposure of 5,509 client credentials and 96 employee credentials, primarily driven by 4,822 historical data breaches and 783 active infostealer logs. The majority of these events are linked to "Combolist sources" within leak repositories, suggesting widespread credential stuffing or reuse of compromised credentials. Malware families like LummaC2, Redline, and Rhadamanthys are prominently featured, indicating active threats targeting user credentials. The timeline shows a notable increase in client credential exposure during March and April 2026, coinciding with a rise in employee credential exposure. The high risk score of 80, coupled with the sheer volume of compromised client and employee data, necessitates immediate attention. The prevalence of infostealer malware and the association with known credential leak sources highlight a critical need to focus on credential hygiene, multi-factor authentication enforcement, and proactive monitoring for unauthorized access attempts targeting services like login.pons.com. Prioritizing the investigation of the March-April 2026 surge in exposures is crucial for understanding the attack vectors and mitigating further impact.