Back

sysco.com Domain Breach Exposure Report

Risk Score

High Risk

Massive event volume or critical assets compromised.

AI Findings Summary

Critical

The telemetry indicates a significant historical data breach affecting approximately 2.75 million clients and 181,000 employees, with a notable surge in client-related exposures in June 2026. Additionally, there are active infostealer logs, primarily targeting Redline malware, impacting over 3,800 instances. The data suggests a broad exposure across client and employee accounts, with a concentration of targeted services including secure login portals and supplier cloud access. Geographically, the United States, Netherlands, and Germany show the highest incidence of these events. The presence of "Combolist sources" and "Database dumps" within leak repositories further suggests compromised credentials are being traded or utilized.

Total Events

2,757,163
credential exposure events

Employee Affected Events

181,822
account email domain = sysco.com

Client Affected Events

2,575,341
service target = sysco.com

Free Community Account

Stop stolen credentials from logging in

Own this domain? Create a free Lunar account to see full exposure data and evidence.

12-Month Events Timeline

Event volume by breach date, employee VS client

EmployeesClients
3,000,0002,000,0001,000,0000
peak month 2,566,474
Jul 25Sep 25Nov 25Jan 26Mar 26May 26Jun 26

Infostealers VS Data Breaches

Live stealer logs VS data breaches

Infostealer logs
Events3,804
Share0%
Data breaches
Events2,753,359
Share100%
Infostealer logs (0%)
3,804events
Data breaches (100%)
2,753,359events

181,822 compromised employee accounts pose an infrastructure risk, while 2,575,341 leaked client credentials create regulatory liability.

Antivirus Distribution

Security Tools on Infected Endpoints

Windows Defender83
FortiClient10
McAfee4
Bitdefender2
Windows Defender McAfee2
Avira2
Windows Defender.1
Reason Cybersecurity1

Malware Families Distribution

Distribution of Active Stealer Strains

Redline2,027
Rhadamanthys299
LummaC2223
Acreed164
RisePro123
Vidar119
X-Files83
Millenium22
Blank Grabber13

Top Login URLs

Top exposed services found in the event results

  1. 1https://secure.sysco.com/signin1,232
  2. 2secure.sysco.com/signin665
  3. 3https://secure.sysco.com472
  4. 4secure.sysco.com458
  5. 5https://secure.sysco.com/424
  6. 6sysco.com407
  7. 7https://idmsupplier.cloud.sysco.com319
  8. 8idmsupplier.cloud.sysco.com296
  9. 9https://idmsupplier.cloud.sysco.com/portal/sps/auth236
  10. 10https://secure.sysco.com/login/login.htm201

Infostealer By Geography

Shows the distribution of Infostealer-related credential exposure events across different geographic regions. The location is determined by analyzing the metadata of the infected machines associated with each event.

United States
Events1,430
Netherlands
Events401
Germany
Events378
Denmark
Events183
Canada
Events61
United Kingdom
Events53
France
Events38

Country Breakdown

  1. 1United States1,430
  2. 2Netherlands401
  3. 3Germany378
  4. 4Denmark183
  5. 5Canada61
  6. 6United Kingdom53
  7. 7Luxembourg45
  8. 8France38

Services Classification Distribution

Blast radius - closer to core = more critical infrastructure, size = credential volume

Microsoft259
Citrix90
Cisco (AnyConnect)33
FortiNet VPN18
F513
Pulse Secure8
Auth04

Operating System Distribution

Distribution of compromised endpoint builds

Windows 11237
Windows 11 24H2 build 26100 (64 Bit)158
Windows Server 2003 R2 x32144
Windows Server 2008 x32140
Windows 10 Home x32134

Leak Repository Classification

Where the exposed records currently reside

0
Named breaches
40,364
Combolist pools
2,712,995
Unattributed dumps

Disclaimer: This report includes AI-generated content. AI can make mistakes, so verify important findings independently before taking action.