reference.com Domain Breach Exposure Report

The telemetry indicates a significant exposure of 560 historical data breaches and 97 active infostealer logs, impacting 244 employees and 413 clients of reference.com over the period of July 2025 to June 2026. The data breaches are predominantly linked to combolist sources (83.4%) and database dumps (16.6%), with malware families like Redline, LummaC2, StealC, and Vidar identified in infostealer logs. The timeline shows a surge in employee and client compromise events in January 2026, followed by a steady increase in client-related events through April 2026. Given the high volume of data breaches and the presence of active infostealer logs, this exposure presents a critical risk. The primary focus for remediation should be on credential hygiene and access control, particularly for employee and client accounts, to mitigate further compromise. Investigating the root cause of the historical data breaches and securing the identified combolist and database dump sources is also paramount. The prevalence of Windows 11 in the observed operating systems suggests that endpoint security on modern Windows environments should be a priority.