visa.com Domain Breach Exposure Report

The telemetry indicates a significant exposure event impacting visa.com, with 186,735 historical data breaches and 24,715 active infostealer logs detected over the reporting period. The majority of these events, 88.3%, are attributed to historical data breaches, while 11.7% are active infostealer logs. The timeline shows a substantial increase in client-related events starting in September 2025 and peaking in March and April 2026, alongside notable employee-related events in January 2026. Key malware families involved include Redline, LummaC2, and Rhadamanthys, all known for credential theft. The primary targeted services are related to secure checkout and commercial payments, with a notable presence of United States and Brazil in the geographical breakdown. The leak repository classification shows a high percentage of data originating from combolist sources (82.9%) and database dumps (17.1%), suggesting compromised credentials and potentially sensitive information. Given the high volume of data breaches and infostealer activity targeting critical payment services, this event poses a severe risk to both employees and clients, potentially leading to widespread financial fraud and identity theft. The prevalence of credential-stealing malware and the nature of the data sources indicate a strong focus on compromising user accounts and payment information. Prioritization should focus on immediate incident response, comprehensive credential compromise analysis, and strengthening authentication mechanisms across all affected services, particularly those related to checkout and commercial payments. A thorough review of data exfiltration channels and the integrity of database dumps is also critical.