Ransomware vs Data Breach

83% of organizations fell victim to a successful ransomware attack in the last 24 months, up from 66% in 2024.

Of organizations hit by ransomware, 75% experience multiple service interruptions.

Only 39% of organizations recover at least 75% of their data after a ransomware attack, down from 57% in 2024.

Twelve vulnerabilities carry confirmed "multi-nexus" attribution, being independently exploited across five distinct threat categories (China, Russia, DPRK, Iran-nexus, and criminal actors).

More than half of mid-market ransomware victims generate less than $50M in annual revenue.

Mid-market organizations accounted for approximately 72–75% of ransomware victims each year.

Compromised credentials accounted for 67% of ransomware intrusions investigated by Beazley Security, down from 74% in Q1.

Public ransomware leak-site postings totaled 2,268, remaining nearly 60% above Q2 2025.

73% of ransomware attacks in North America and Europe hit companies with $10M to $1B in annual revenue from 2023 through the first half of 2026.

27% of healthcare organizations cite cybersecurity threats and ransomware as the #1 network challenge, 23% cite staffing shortages and lack of expertise, 20% cite rising operational and compliance costs, 16% cite network reliability impacting clinical systems, and 15% cite aging or fragmented infrastructure.

Professional services recorded 69.9 million ransomware hits in the first half of 2026, more than any other vertical.

Ten active ransomware families operated simultaneously against the professional services sector in the first half of 2026, including Filecoder (19.1 million hits across 113 organizations), Gandcrab (11.9 million) and Ryuk (10.5 million).

460 organizations in the professional services sector are actively detecting ransomware campaigns, representing the broadest exposure of any vertical.

Ransomware remained the most persistent and disruptive cyber threat to industrial organizations in Q2 2026

Manufacturing was the most affected sector by ransomware incidents affecting industrial organizations worldwide, with 747 incidents (65%) across all subsectors in Q2 2026.

62% of UK organisations experience material data loss, down from 74% in 2025.

Among UK organisations that experienced material data loss, compromised insiders were the leading cause at 48%, with malicious or criminal insiders cited by 44% and careless insiders by 37%.

95% of UK CISOs at organisations experiencing material data loss say departing employees played a role.

76% of organizations report their largest data loss event exceeded their Recovery Point Objective (RPO) targets.

In the second quarter (Q2) of 2026, analysis of publicly disclosed victim data and ransomware groups’ postings on Data Leak Sites (DLS) identified 1,140 ransomware incidents affecting industrial organizations worldwide, a 12% increase over the 1,020 incidents recorded in Q1.

In the past 12 months, 27% of organizations reported data breaches tied to AI use.

Sensitive information disclosure ranks as the second biggest LLM threat for a second consecutive year.

11% of reported cybercrime cases in Africa in 2025 involved data breaches.

The global breach average is $4.99 million.

AI-enabled malicious breaches increased by 56% over the previous year.

Financial services breaches cost on average $6.3 million.

73% of organizations have found their workforce’s credentials in breach, Dark Web, or infostealer data in the past year

Nearly 693,000 records are known to have been breached in the confirmed education-sector ransomware attacks in H1 2026.

Only 24% of H1 2026 breach notices contained attack-vector details, the lowest rate ever recorded by the ITRC.

Financial services recorded the highest frequency of compromises by sector at 387.