rossstores.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event affecting rossstores.com, with 56,202 historical data breaches and 1,789 active infostealer logs observed between July 2025 and June 2026. The majority of these events are linked to "Combolist sources" (56.3%) and "Database dumps" (43.7%), suggesting credential stuffing and data exfiltration as primary attack vectors. Malware families such as Redline (98.3%), Rhadamanthys, and LummaC2 are prevalent, often targeting employee credentials, as evidenced by the high volume of employee-related events (57,414). The data breaches and infostealer activity are concentrated in the United States and Netherlands, with targeted services including the company's career portal and general web traffic. The timeline shows a surge in employee-related events in January 2026, potentially indicating a large-scale credential compromise. Given the high volume of historical data breaches and active infostealer logs, this incident poses a critical risk to the organization. The prevalence of Redline infostealer, known for stealing credentials and sensitive information, combined with the targeting of employee accounts and the career portal, suggests a high likelihood of further compromise and potential financial or reputational damage. Prioritization should focus on immediate credential reset for all employees, enhanced monitoring of the career portal, and a thorough investigation into the source of the database dumps and combolists to prevent future exploitation.