ups.com Domain Breach Exposure Report

The telemetry indicates a significant exposure of UPS customer data, with over 1.8 million historical data breaches and 264,000 active infostealer logs observed within the reporting period. The data breaches primarily originate from "Combolist sources" (94.2%) and "Database dumps" (5.8%), suggesting compromised credentials or leaked databases are a major vector. Infostealer activity is linked to malware families like LummaC2, Redline, and Rhadamanthys, which are known for exfiltrating sensitive information. The targeted services include login pages and signup portals, indicating an attempt to compromise user accounts. The majority of the observed activity is concentrated in the United States, France, and Italy. The high volume of client-related events (1.9 million) compared to employee events (162,000) suggests a focus on customer data rather than internal corporate systems. Given the scale of data breaches and active infostealer campaigns targeting customer-facing services, this exposure presents a critical risk of account takeovers, identity theft, and further downstream compromise of customer information. The prevalence of combolists and database dumps points to a need for enhanced credential stuffing defenses and proactive monitoring for leaked data. Remediation efforts should focus on strengthening authentication mechanisms, implementing robust data loss prevention strategies, and actively monitoring for and mitigating infostealer malware infections, particularly those associated with the identified malware families. Prioritizing the security of customer login and signup portals is essential.