ulta.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event for ulta.com, with over 105,000 total events recorded during the reporting period. A substantial portion of these events, approximately 87%, are classified as historical data breaches, while the remaining 13% are active infostealer logs. The data shows a concerning spike in employee-related events in January 2026, with over 18,000 incidents, contrasting with a more distributed pattern of client-related events throughout the year. The primary malware families associated with these events are Rhadamanthys, Redline, and LummaC2, all known for their credential-stealing capabilities. The majority of the exposure originates from combolist sources and database dumps, suggesting compromised credentials are a key vector. The high volume of historical data breaches and active infostealer logs, coupled with the prevalence of credential-stealing malware targeting ulta.com services, presents a critical risk. The significant spike in employee-related events in January 2026 warrants immediate investigation to understand the cause and scope of that specific incident. Remediation efforts should focus on credential hygiene, including mandatory password resets for employees and clients, enhanced monitoring for suspicious login activity, and a review of data access controls. Given the nature of the domain, the most appropriate industry sector is Retail & E-commerce.