windows.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event affecting the domain windows.com, with a total of 7,988 recorded events between July 2025 and June 2026. The majority of these events, 97%, are classified as historical data breaches, totaling 7,745 instances. Additionally, there are 243 active infostealer logs, representing 3% of the total events. The timeline shows a peak in employee and client-related events in September 2025, with 2,806 employee and 165 client events, and another surge in employee events in February 2026 with 1,643 instances. Malware families associated with these events include Redline (21%), Rhadamanthys (11.1%), and LummaC2 (8.6%). The high volume of historical data breaches and active infostealer logs, coupled with the targeting of services like windows.com and its subdomains, suggests a high-priority risk. The presence of common infostealer malware families indicates a potential for credential harvesting and further compromise. Remediation efforts should focus on identifying the root cause of the data breaches, enhancing security controls to prevent further infostealer activity, and reviewing access logs for compromised employee and client accounts. The data also shows a notable percentage of events originating from Thailand (33%) and the United States (23%).