wikimedia.org Domain Breach Exposure Report

The telemetry indicates a significant exposure event affecting Wikimedia.org, with a total of 143,034 events recorded between July 2025 and June 2026. The majority of these events, 76.8%, are historical data breaches, and 23.2% are active infostealer logs. A substantial number of client accounts, 142,390, and 644 employee accounts were involved. The timeline shows a notable increase in client-related events starting in March 2026, coinciding with a rise in employee account involvement in January 2026. Malware families such as Rhadamanthys, LummaC2, and Acreed are prominently featured in the infostealer logs. The data breaches appear to originate from "Combolist sources" (99.6%), suggesting credential stuffing or similar attacks leveraging previously compromised credentials. Targeted services include Wikimedia Commons and authentication endpoints, indicating potential attempts to gain unauthorized access to user accounts or content.