regions.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting regions.com, with over 115,000 historical data breaches and over 11,000 active infostealer logs detected within the reporting period. The majority of these events are linked to combolist sources and database dumps, suggesting credential stuffing or account takeover attempts. A substantial number of employee and client credentials appear to be compromised, with a notable surge in employee-related events in January 2026 and client-related events in March 2026. Malware families such as Rhadamanthys, Redline, and LummaC2 are prevalent, indicating active credential harvesting operations. The high volume of data breaches and infostealer activity, coupled with the targeting of login services, presents a critical risk of unauthorized access and further compromise. The prevalence of Windows operating systems and common antivirus solutions suggests a broad impact across user endpoints. Prioritization should focus on immediate credential reset campaigns for both employees and clients, enhanced monitoring of login endpoints, and a thorough investigation into the root cause of the data breaches and infostealer infections to prevent recurrence.