sony.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting sony.com, with over 10 million total events logged between July 2025 and June 2026. The majority of these events, approximately 80%, are classified as historical data breaches, while the remaining 20% are active infostealer logs. This suggests a persistent threat landscape where both past compromises and ongoing credential harvesting are prevalent. The exposure primarily affects clients, with over 10 million client-related events, and a smaller but notable number of employee-related events (22,453). Key targeted services include various login portals for sony.com accounts, indicating a focus on account takeover and credential stuffing. The data also highlights the prevalence of infostealer malware families such as Rhadamanthys, LummaC2, and Redline, which are commonly used to exfiltrate credentials and sensitive information. The geographical distribution shows a concentration of affected users in the United States, Brazil, and France. The leak repository classification indicates that a vast majority of the exposed data originates from combolist sources, suggesting large-scale credential stuffing attacks leveraging previously breached credentials.