rae.es Domain Breach Exposure Report

The domain rae.es has experienced a significant number of data breach events, totaling 1008, which constitute the vast majority of observed exposures. Additionally, there are 227 instances of infostealer activity, indicating potential credential harvesting. The timeline shows a surge in client-related events starting in September 2025 and peaking in March and April 2026, with employee-related events also increasing during this period. The primary sources of leaked data appear to be combolist sources, suggesting compromised credentials. Malware families associated with these events include Redline, Vidar, and LummaC2, all known for their credential-stealing capabilities. The targeted services are primarily related to user registration and login portals for enclave.rae.es and rae.es. Given the high volume of data breaches and infostealer activity, coupled with the targeting of authentication services, this situation presents a critical risk. The prevalence of combolists as a leak source indicates a high likelihood of compromised user accounts, potentially affecting both employees and clients. Remediation should focus on immediate credential rotation for all affected users, enhanced monitoring of authentication logs for suspicious activity, and a thorough review of security configurations for the enclave.rae.es and rae.es platforms to prevent further exploitation.