rakuten.co.jp Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting rakuten.co.jp, with a total of 837,799 recorded events over the period from July 2025 to June 2026. The majority of these events, approximately 84.5%, are classified as historical data breaches, affecting 708,249 entities, likely clients. An additional 15.5% of events, totaling 129,550, are attributed to active infostealer logs. The timeline shows a notable increase in client-related events in March 2026, with 215,346 occurrences, and a corresponding rise in employee-related events in the same month (176). The primary source of these breaches appears to be combolist sources, suggesting credential stuffing or similar attacks leveraging compromised credentials. The high volume of historical data breaches and active infostealer logs, coupled with the large number of affected clients, presents a critical risk. The prevalence of malware families such as LummaC2, Rhadamanthys, and Redline, commonly associated with credential harvesting and data exfiltration, further elevates the concern. Remediation efforts should focus on strengthening credential security, implementing robust multi-factor authentication across all client and employee accounts, and enhancing endpoint detection and response capabilities to identify and mitigate infostealer activity.