who.int Domain Breach Exposure Report

The domain who.int has experienced a significant number of data breaches and infostealer events, with over 132,000 historical data breaches and over 27,000 active infostealer logs recorded between July 2025 and June 2026. These events primarily involve client data, with a notable increase in employee-related events in September 2025 and March 2026. The most prevalent malware families are LummaC2, Redline, and Rhadamanthys, often associated with combolist sources and database dumps, suggesting credential stuffing or account takeover attempts. The targeted services are predominantly related to the careers portal, indicating a focus on compromising user credentials for recruitment or employment-related platforms. Geographically, India, Ethiopia, and Egypt show the highest incidence of related events. Given the high volume of data breaches and infostealer activity, coupled with the targeting of client and employee data, this exposure presents a critical risk. The prevalence of LummaC2 and Redline, known for credential harvesting, combined with the use of combolists, points to a high likelihood of compromised accounts being exploited. Prioritization should focus on immediate remediation of vulnerabilities on the careers portal, enhanced credential security measures, and comprehensive incident response to address the ongoing data breach and infostealer activity. The primary risk is the potential for widespread account compromise and sensitive data exfiltration affecting both individuals and the organization.