rockwellautomation.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting Rockwell Automation, with over 111,000 historical data breaches and nearly 19,000 active infostealer logs detected within the reporting period. The majority of these events are linked to "Combolist sources" and "Database dumps," suggesting credential stuffing or account takeover attempts. Malware families such as Redline, LummaC2, and Rhadamanthys are prevalent, indicating active compromise and data exfiltration. The targeted services include identity providers and account creation portals, highlighting a focus on gaining unauthorized access to user accounts and potentially sensitive systems. The geographical distribution shows a notable concentration of activity originating from India, Mexico, and the United States. The high volume of data breaches and infostealer activity, coupled with the presence of multiple malware families, warrants immediate attention and a thorough investigation into the root cause and extent of the compromise.