so-net.ne.jp Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting the so-net.ne.jp domain, with a high risk score of 98. The primary concern stems from a large volume of historical data breaches (37,935 events) and active infostealer logs (3,657 events) observed between July 2025 and June 2026. These events are strongly correlated with "Combolist sources" (81.8%) and "Database dumps" (18.2%) within leak repositories, suggesting compromised credentials are a major vector. The timeline shows a notable increase in client-related events from August 2025 onwards, peaking in March 2026, alongside fluctuating but consistent employee-related events throughout the period. The prevalence of infostealer malware families like LummaC2, Redline, and Rhadamanthys, coupled with the sheer volume of data breach events, elevates the risk to critical. The primary focus for remediation should be on credential hygiene, including mandatory password resets for all users, enhanced multi-factor authentication deployment, and a thorough review of access controls for services like the so-net.ne.jp login portal and mypage. Investigating the source of the "Combolist sources" and "Database dumps" is also crucial to understand the initial compromise and prevent recurrence.