thomsonreuters.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting thomsonreuters.com, with a total of 172,652 recorded events over the period. The majority of these events are categorized as historical data breaches (84.6%) and active infostealer logs (15.4%). A substantial number of employee (62,923) and client (109,729) records are associated with these events. The timeline shows a sharp increase in employee and client-related events in September 2025 and January 2026, suggesting potential targeted campaigns or widespread compromise during those periods. Malware families commonly associated with these events include LummaC2, Redline, and Rhadamanthys, all known for credential harvesting and data exfiltration. The high volume of historical data breaches and active infostealer logs, coupled with the large number of affected employee and client records, elevates the risk to a critical level. The prevalence of credential-harvesting malware targeting authentication services like "https://auth.thomsonreuters.com/u/login/password" and "https://signon.thomsonreuters.com/" indicates a strong focus on compromising user accounts. Remediation efforts should prioritize incident response for ongoing infostealer activity, thorough investigation of all historical data breaches, and immediate enhancement of authentication security controls, including multi-factor authentication and credential rotation for all affected users.