wp.com Domain Breach Exposure Report

The telemetry indicates a significant exposure of employee and client credentials, with 8,642 employee and 1,205 client records compromised. This is primarily driven by historical data breaches (9,436 events) and active infostealer logs (529 events) over the period from July 2025 to June 2026. The most prevalent malware families associated with these infostealer logs are Redline, Rhadamanthys, and LummaC2. The targeted services are predominantly related to wp.com, suggesting a focus on WordPress-related infrastructure. The data originates from various countries, with Poland being the most represented. Given the high volume of compromised credentials and the active nature of infostealer activity, this exposure presents a critical risk. The prevalence of WordPress-related targets and the use of common infostealers necessitate immediate remediation efforts focused on credential rotation, enhanced monitoring for unauthorized access to wp.com services, and strengthening security controls around WordPress deployments. Prioritization should be given to mitigating further data exfiltration and preventing account takeovers.