xero.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting xero.com, with 150,861 historical data breaches and 38,594 active infostealer logs detected. The majority of these events, 79.6%, are attributed to historical data breaches, while 20.4% are active infostealer logs. The timeline shows a surge in client-related events in September 2025 and January 2026, with a notable increase in employee-related events in January 2026. Malware families like LummaC2, Rhadamanthys, and Redline are prevalent, suggesting credential harvesting and data exfiltration activities. The primary targeted services are login endpoints for xero.com, indicating a focus on user authentication mechanisms. The data originates primarily from Australia, the United Kingdom, and the Philippines. The leak repository classification shows a high percentage of events originating from "Combolist sources" (97.2%), suggesting compromised credential reuse. Given the high volume of data breaches and active infostealer logs, coupled with the targeting of login services, the priority for remediation should be on strengthening authentication mechanisms, credential hygiene, and monitoring for unauthorized access. The prevalence of infostealer malware families targeting user credentials necessitates a review of endpoint security and user awareness training. The significant volume of historical data breaches also warrants an investigation into the root causes and potential impact on affected individuals.