wa.gov Domain Breach Exposure Report

The domain wa.gov experienced a significant exposure event, with 150,781 historical data breaches and 33,181 active infostealer logs detected. The majority of these events, 82%, are attributed to historical data breaches, while 18% are active infostealer logs. A notable surge in employee-related events occurred in January 2026, with 14,562 incidents, alongside a substantial number of client-related events throughout the reporting period, particularly in March 2026 (45,426). The primary malware families identified are LummaC2 (16.8%), Rhadamanthys (14.1%), and Acreed (9.7%). The exposure is heavily concentrated in the United States (99.9%), with a significant portion of the data originating from combolist sources (89.9%) and database dumps (10.1%). Given the high volume of historical data breaches and active infostealer logs, coupled with the large number of affected clients and employees, this exposure poses a critical risk. The prevalence of infostealer malware targeting sensitive data and the potential for credential compromise necessitates immediate attention. Prioritization should focus on incident response, threat hunting to identify and contain active infections, and comprehensive security posture review, including access controls and data protection mechanisms for services like secure.esd.wa.gov and secure.dol.wa.gov.