renren.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting renren.com, with 124,250 client accounts and 520 employee accounts compromised. The primary threat vectors identified are historical data breaches, accounting for 96.5% of the total events, and active infostealer logs at 3.5%. Malware families such as Redline, LummaC2, and Rhadamanthys are prevalent, suggesting credential harvesting and data exfiltration. The exposure period spans from July 2025 to June 2026, with notable spikes in client compromise during March and April 2026. The majority of affected systems are running Windows 11 and Windows 10, with common antivirus solutions like Windows Defender in use. The data originates primarily from China and the United States. Given the high volume of data breaches and the presence of infostealer activity targeting client and employee credentials, this incident poses a critical risk. The prevalence of combolist sources in leak repositories further suggests that compromised credentials may be reused across services. Prioritization should focus on immediate credential rotation for all affected employees and clients, enhanced monitoring for suspicious login activity, and a review of access controls for renren.com. Further investigation into the specific data exfiltrated during the breaches and infostealer campaigns is recommended.