santander.co.uk Domain Breach Exposure Report

The telemetry indicates a significant exposure of Santander UK customer and employee data, with 44,824 historical data breaches and 7,812 active infostealer logs observed over the past year. The data breaches primarily originate from "Combolist sources" (83.8%) and "Database dumps" (16.2%), suggesting compromised credentials and potentially sensitive information have been exfiltrated. The infostealer activity is dominated by malware families such as LummaC2, Rhadamanthys, and Acreed, which are known for stealing credentials and sensitive data from infected systems. The timeline shows a notable surge in employee-related events in January 2026, coinciding with a large number of client-related events in March 2026, indicating a potential escalation or widespread compromise during these periods. The targeted services include the retail online banking and open banking portals, highlighting direct access to customer accounts. Given the high volume of data breaches and active infostealer activity targeting critical banking services, this exposure presents a severe risk to Santander UK and its customers. The prevalence of credential-stuffing attacks, indicated by the "Combolist sources," combined with sophisticated infostealer malware, suggests a high likelihood of account takeovers and further data exfiltration. Prioritization should focus on immediate remediation of identified vulnerabilities, enhanced credential hygiene for both employees and clients, and robust monitoring of the retail and open banking platforms for suspicious login activity. The observed malware families require specific threat intelligence and blocking rules.