xylem.com Domain Breach Exposure Report

The telemetry indicates a significant exposure of 2,562 historical data breaches and 503 active infostealer logs affecting xylem.com between July 2025 and June 2026. The data breaches represent 83.6% of the total observed events, while infostealer logs constitute 16.4%. A notable surge in employee and client-related events occurred in January 2026, with 633 employee and 62 client events recorded. The most prevalent malware families associated with these events are RisePro (19.3%), Vidar (16.1%), and Redline (11.1%), all of which are known infostealers. The telemetry also highlights targeted services, including various login endpoints for cloud and single sign-on (SSO) systems, and identifies Germany as the country with the highest number of associated events (271). The data leak repositories are primarily composed of combolist sources (45.5%) and database dumps (54.5%). Given the high volume of historical data breaches and the prevalence of infostealer malware targeting authentication services, the priority should be on immediate incident response and comprehensive security posture review. The focus should be on identifying the root cause of the historical breaches, enhancing credential protection mechanisms, and implementing robust detection and response capabilities for active infostealer threats. Remediation efforts should prioritize securing authentication infrastructure, reviewing access controls, and conducting thorough security awareness training for employees, given the substantial number of employee-related events.