truist.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting truist.com, with a total of 89,400 recorded events over the period from July 2025 to June 2026. The majority of these events, 70.1%, are historical data breaches, and 29.9% are active infostealer logs. A substantial number of client accounts, 83,262, and employee accounts, 6,138, are affected. The timeline shows a sharp increase in employee and client events in January 2026, and again in March and April 2026, suggesting a period of heightened activity or discovery. Malware families such as Rhadamanthys, Redline, and LummaC2 are prevalent, often associated with infostealer activities. The data originates primarily from the United States, with smaller amounts from the United Kingdom and Nigeria. The high volume of historical data breaches and active infostealer logs, coupled with the large number of affected employees and clients, presents a critical risk. The prevalence of infostealer malware indicates a direct threat to credential harvesting and potential financial fraud. The concentration of events targeting login pages for truist.com and its associated banking portal, dias.bank.truist.com, highlights the specific focus of these attacks. Remediation should prioritize incident response for the identified data breaches and infostealer activity, enhanced monitoring of authentication systems, and user education regarding credential security.