schwab.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting schwab.com, with 202,518 historical data breaches and 40,670 active infostealer logs detected between July 2025 and June 2026. The majority of these events are linked to compromised credentials from "Combolist sources" (81.3%) and "Database dumps" (18.7%). Malware families such as Rhadamanthys, Redline, and LummaC2 are prevalent, targeting Windows 11 and Windows 10 operating systems. The primary affected services include gateways and login portals, with the United States being the most frequently observed geography. Given the high volume of historical data breaches and active infostealer logs, this situation presents a critical risk of further credential compromise and potential financial fraud. The prevalence of infostealer malware suggests that attackers are actively harvesting credentials, likely leading to unauthorized access to client and employee accounts. Prioritization should focus on immediate credential reset campaigns for affected users, enhanced monitoring of critical login portals, and a comprehensive review of data access controls to mitigate the risk of ongoing or future data exfiltration.