zoom.us Domain Breach Exposure Report

The telemetry indicates a significant exposure impacting over 17 million clients and 6,600 employees, primarily driven by historical data breaches (81.5%) and active infostealer logs (18.5%). The data suggests widespread credential compromise, with "Combolist sources" accounting for 99.9% of leak repository classifications. Malware families such as Redline, LummaC2, and Rhadamanthys are prevalent, targeting services like Zoom sign-in pages. The geographic distribution shows a notable concentration of affected users in India, Indonesia, and the United States. The timeline reveals a surge in employee and client data exposure during January 2026. Given the high volume of client data breaches and active infostealer logs, this poses a critical risk of account takeover, identity theft, and further downstream compromise. The prevalence of infostealers targeting authentication endpoints like Zoom sign-in pages suggests an active threat actor campaign. Prioritization should focus on immediate credential reset campaigns for affected employees and clients, enhanced monitoring for suspicious login activity, and a review of authentication security controls. The broad geographic spread necessitates a global response strategy.