sagawa-exp.co.jp Domain Breach Exposure Report

The telemetry indicates a significant exposure of client data, with 58,993 client records compromised, primarily through historical data breaches accounting for 86.5% of all events. Employee data was also affected, with 284 records compromised. The exposure period spans from July 2025 to June 2026, with notable spikes in client data compromise in September 2025 and March 2026. Infostealer activity is also present, with 8,021 logs detected, predominantly from malware families such as Rhadamanthys, LummaC2, and Redline. The targeted services are primarily related to the "e-service.sagawa-exp.co.jp" domain, suggesting a focus on the company's online service portal. Given the high volume of client data breaches and the presence of infostealer malware, this exposure presents a critical risk. The primary remediation focus should be on securing the "e-service.sagawa-exp.co.jp" domain and associated infrastructure, investigating the root cause of the historical data breaches, and enhancing endpoint security to detect and prevent infostealer infections. The prevalence of Windows 11 and Windows 10 operating systems in the telemetry suggests that patching and security hardening efforts should prioritize these platforms.