readthedocs.org Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting 13,450 clients and 125 employees, primarily through historical data breaches (76.8%) and active infostealer logs (23.2%). The exposure period spans from July 2025 to June 2026, with a notable increase in employee-related events in early 2026. Malware families such as Rhadamanthys, LummaC2, and Vidar are prevalent, targeting Windows operating systems. The primary source of leaked data appears to be combolist sources, suggesting credential stuffing or account takeover attempts against the readthedocs.org service. The high risk score of 85 warrants immediate attention. The prevalence of infostealer logs and data breaches points to potential credential compromise and unauthorized access. Prioritization should focus on identifying compromised employee and client accounts, revoking credentials associated with the readthedocs.org service, and enhancing authentication mechanisms. Further investigation into the specific data exfiltrated and the attack vectors used is crucial for comprehensive remediation.