wsj.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event affecting wsj.com, with 48,399 total events recorded between July 2025 and June 2026. The majority of these events, 84.1%, are historical data breaches, while 15.9% are active infostealer logs. Employee and client data appear to be compromised, with a notable surge in employee-related events in January 2026 and client-related events in March 2026. The primary malware families involved are Rhadamanthys, LummaC2, and Redline, all known for credential theft. The data originates predominantly from the United States, with secondary origins in India and Japan. The exposure is linked to "Combolist sources" and "Database dumps," suggesting compromised credentials and potentially large-scale data exfiltration. Given the high volume of data breaches and the prevalence of infostealer malware targeting credential harvesting, this incident poses a critical risk. The focus should be on immediate remediation of compromised accounts, strengthening authentication mechanisms, and investigating the root cause of the data breaches and infostealer activity. Prioritize the protection of employee and client data by implementing robust security controls and conducting thorough audits of affected systems and services, particularly those related to registration and user identification.