thingiverse.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting approximately 307,170 clients of thingiverse.com, with a smaller number of employee accounts also affected. The primary threat vectors identified are historical data breaches, accounting for 84.4% of the event volume, and active infostealer logs, representing 15.6%. Malware families such as LummaC2, Redline, and Rhadamanthys are prevalent in the infostealer logs. The targeted services are predominantly related to account registration and login functions on thingiverse.com. The data breach information originates from combolist sources, suggesting credential stuffing or similar attacks leveraging previously compromised credentials. The timeline shows a notable increase in both employee and client-related events starting in March 2026, peaking in April 2026, and continuing through June 2026. Given the high volume of client data breaches and active infostealer activity targeting authentication services, this exposure presents a critical risk. The reliance on combolist sources for breach data indicates a high likelihood of credential stuffing attacks against user accounts. The prevalence of infostealers suggests that user credentials, potentially including those for thingiverse.com, may have been exfiltrated from other sources and are being actively used. Remediation efforts should focus on immediate credential reset campaigns for all affected users, enhanced monitoring for suspicious login activity, and a review of authentication and authorization controls on the affected services. The industry sector is classified as Retail & E-commerce due to the nature of the platform.