hootsuite.com Domain Breach Exposure Report | Lunar Domain Exposure<br>hootsuite.com Domain Breach Exposure Report

ScanScan Domain<br>Access via API<br>Risk Score

100<br>/ 100

High Risk<br>Massive event volume or critical assets compromised.

About the Risk Score<br>This score measures your organization's overall exposure level based on the total volume of detected leaks.<br>How it's weighted:<br>Employee Leaks : Given a much higher weight, as compromised internal accounts pose an immediate threat to corporate infrastructure.<br>Sensitive Services : Exposure of critical access points (like VPNs, firewalls, or identity providers) heavily accelerates the score.<br>Customer Leaks : Weighted normally to reflect compliance and reputational risk.

Score range: 0 to 100 (Critical).

AI Findings Summary

Critical

The telemetry indicates a significant exposure event impacting hootsuite.com, with over 346,000 total events recorded during the reporting period. The majority of these events, approximately 89%, are classified as historical data breaches, while 10.9% are active infostealer logs. A substantial number of client accounts (346,082) and employee accounts (400) are affected. Malware families such as LummaC2, Rhadamanthys, and Acreed are prominently featured in the infostealer logs. The data suggests a strong correlation with "Combolist sources" (99.9%) within leak repositories, indicating credential stuffing or similar attacks leveraging previously compromised credentials.

The high volume of historical data breaches and active infostealer logs, coupled with the targeting of hootsuite.com login and billing endpoints, suggests a high-priority risk. The prevalence of infostealer malware targeting Windows 11 and Windows 10 operating systems, with a notable presence in India and the United States, points to a broad attack surface. Remediation efforts should focus on immediate credential rotation for affected employees and clients, enhanced monitoring for suspicious login activity, and a review of authentication mechanisms to mitigate credential stuffing and infostealer threats.<br>Read full report

Total Events

346,482<br>credential exposure events<br>About Total Events<br>The cumulative count of all credential exposure events detected across your organization's employees and clients. Since a single individual or account can be compromised in multiple separate breaches over time, one person may be linked to multiple exposure events.

Employee Affected Events

400<br>account email domain = hootsuite.com<br>About Employee Affected Events<br>The total number of exposure events associated specifically with corporate employee accounts. A single employee can be linked to multiple separate events. This tracks the frequency of internal compromises posing a direct threat to your network.

Client Affected Events

346,082<br>service target = hootsuite.com<br>About Client Affected Events<br>The total number of exposure events associated with external client accounts. A single customer can be involved in multiple separate leaks. This tracks the total volume of brand exposure, representing risks to compliance and privacy.

Check your company's exposed credentials<br>Create Your Free Account

12-Month Events Timeline

Event volume by breach date, employee VS client

EmployeesClients

EmployeesClients<br>80,00053,33326,6670

peak month 75,135<br>Aug 25Sep 25Oct 25Nov 25Dec 25Jan 26Feb 26Mar 26Apr 26May 26Jun 26Jul 26

Infostealers VS Data Breaches

Live stealer logs VS data breaches

Infostealer logs<br>Events37,935<br>Share11%

Data breaches<br>Events308,547<br>Share89%

Infostealer logs (11%)<br>37,935 events

Data breaches (89%)<br>308,547 events

400 compromised employee accounts pose an infrastructure risk, while 346,082 leaked client credentials create regulatory liability.

Antivirus Distribution

Security Tools on Infected Endpoints

Windows Defender1,678

Windows Defender.58

Windows Defender McAfee Anti-Virus and Anti-Spyware32

Windows Defender McAfee26

McAfee VirusScan25

Avast22

Webroot SecureAnywhere20

Windows Defender Trend Micro Internet Security19

Windows Defender Panda Dome18

Windows Defender<br>1,678

Windows Defender.<br>58

Windows Defender McAfee Anti-Virus and Anti-Spyware<br>32

Windows Defender McAfee<br>26

McAfee VirusScan<br>25

Avast<br>22

Webroot SecureAnywhere<br>20

Windows Defender Trend Micro Internet Security<br>19

Windows Defender Panda Dome<br>18

Malware Families Distribution

Distribution of Active Stealer Strains

LummaC25,780

Rhadamanthys4,531

Acreed3,689

Vidar2,755

Redline2,087

Remus690

Blank Grabber420

Millenium383

Cthulhu238

LummaC2<br>5,780

Rhadamanthys<br>4,531

Acreed<br>3,689

Vidar<br>2,755

Redline<br>2,087

Remus<br>690

Blank Grabber<br>420

Millenium<br>383

Cthulhu<br>238

Top Login URLs

Top exposed services found in the event...