salesforce.com Domain Breach Exposure Report

The telemetry indicates a significant exposure related to Salesforce, with over 1.3 million events logged between July 2025 and June 2026. The majority of these events (82.1%) are historical data breaches, and a substantial portion (17.9%) are active infostealer logs. The data suggests a broad impact, affecting over 1.2 million clients and over 100,000 employees. The timeline shows a surge in client-related events in September 2025 and January 2026, and employee-related events also spiked in January 2026. The primary malware families associated with these events are LummaC2, Redline, and Rhadamanthys, all known for credential theft. The exposure is heavily concentrated in India, with the United States and Brazil also showing notable activity. The data originates primarily from combolist sources (90.6%), indicating compromised credential reuse. Given the high volume of data breaches and active infostealer logs targeting client and employee accounts, this exposure presents a critical risk. The prevalence of infostealers and the reliance on combolist sources suggest a high likelihood of credential stuffing attacks and further account takeovers. Prioritization should focus on immediate credential rotation for affected users, enhanced monitoring for suspicious login activity on Salesforce instances, and a review of access controls. The focus should be on mitigating further unauthorized access and preventing the exploitation of compromised credentials.