so.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event affecting the domain so.com, with a total of 14,527 events recorded over the period from July 2025 to June 2026. The majority of these events, 14,042 (96.7%), are classified as historical data breaches, while 485 (3.3%) are active infostealer logs. The data breaches appear to be primarily sourced from "Combolist sources" (93%) and "Database dumps" (7%). Infostealer activity is dominated by malware families such as Redline (24.9%), Rhadamanthys (19%), and LummaC2 (9.3%), targeting Windows operating systems. The timeline shows a surge in employee and client-related events in August 2025 and February 2026, with a notable increase in client events in March and April 2026. Geographically, China accounts for the highest proportion of related events (0%). Given the high volume of historical data breaches and the presence of active infostealer logs, this exposure poses a critical risk to the organization. The prevalence of credential stuffing indicators from combolists suggests a high likelihood of account compromise for both employees and clients. The focus for remediation should be on immediate credential reset for all affected users, enhanced monitoring for suspicious login activity, and a thorough review of data security practices to prevent future data exfiltration. The targeted services indicate a focus on authentication mechanisms, including so.com, so.com/sso/login, and related endpoints.