Visual Intelligence, Inc. Data Breach

Visual Intelligence, Inc., a US-based intelligence and data services provider, was identified on MetaEncryptor’s dark web portal on September 21, 2026, as part of a group of victims claimed on the same day. The threat intelligence analysis from SOCRadar’s Dark Web Monitoring flagged this listing. A notable stealer-log finding indicated that credentials surfaced against an endpoint specifically associated with datasets, raising concerns about potential data exposure. MetaEncryptor has claimed 20 other victims within the last 60 days, with a focus on targets in the United States, South Korea, and Japan, across the Manufacturing, Healthcare, and Technology sectors. The inclusion of Visual Intelligence, Inc. aligns with the ransomware group’s pattern of targeting US-market technology and data-services companies.

SOCRadar’s investigation identified two records targeting the subdomain datasets.visualintelligenceinc[.]com. These records are dated between May and July 2026. The username associated with these records was masked, making it impossible to determine if the credential belonged to an employee or an external user. This identical masked username across both records suggests either a single, persistent compromised account or the reuse of credentials. The high-value nature of the targeted endpoint, datasets.visualintelligenceinc[.]com, is significant for an intelligence organization, as it may grant access to sensitive datasets, APIs, or partner access controls. The limited number of records identified represents a minimum exposure, as the paginated sample may not encompass the full extent of compromised credentials. The masked username prevents a full stratification of risk, but the presence of two records with identical credentials against a data access endpoint over a two-month period without apparent rotation points to a potential security vulnerability. This situation warrants immediate investigation into unauthorized access on datasets.visualintelligenceinc[.]com between May and July 2026 to determine if it functions as an API gateway to internal data stores.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.