stubhub.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event affecting stubhub.com, with over 124,000 total events recorded between July 2025 and June 2026. The majority of these events are classified as historical data breaches (87.6%) and active infostealer logs (12.4%). A substantial number of client records (120,908) and employee records (3,290) appear to be compromised. The timeline shows a sharp increase in employee-related events in January 2026, coinciding with a broader surge in client events. Malware families such as Rhadamanthys, LummaC2, and Redline are prevalent. The data suggests a strong correlation with combolist sources (97.8%) within leak repositories, indicating credential stuffing or similar attacks leveraging previously breached credentials. The primary geographic origin of affected systems is the United States. Given the high volume of data breaches and infostealer activity, coupled with the compromise of both employee and client data, this incident poses a critical risk. The prevalence of infostealer malware and the reliance on combolists suggest a focus on credential harvesting and potential account takeover. Prioritization should be placed on immediate investigation into the root cause of the data breaches and infostealer infections, strengthening authentication mechanisms, and conducting thorough credential hygiene for both employees and clients. Remediation efforts should focus on mitigating further credential compromise and addressing the identified malware families.