Ransomware vs Data Breach

Big game hunting adversaries named 572 technology entities on dedicated leak sites for extortion.

Professional services recorded 69.9 million ransomware hits in the first half of 2026, more than any other vertical.

Ten active ransomware families operated simultaneously against the professional services sector in the first half of 2026, including Filecoder (19.1 million hits across 113 organizations), Gandcrab (11.9 million) and Ryuk (10.5 million).

460 organizations in the professional services sector are actively detecting ransomware campaigns, representing the broadest exposure of any vertical.

7% of reported cybercrime cases in Africa in 2025 involved ransomware or Banking Trojan stealers.

The highest ransom demand in Q2 2026 was $25 million.

Qilin accounted for 285 undisclosed attacks (14%), The Gentlemen accounted for 219 (11%), and Dragon Force accounted for 137 (7%) in Q2 2026.

The number of undisclosed ransomware attacks fell 6% compared to the previous quarter.

41% of ransomware attacks exploited brand reputation.

35% of ransomware attacks exploited employee data.

31% of ransomware attacks exploited intellectual property.

Ransomware incidents made up over 20% of Cisco Talos Incident Response engagements this quarter, similar to just under 20% last quarter.

Threat actors maintained undetected access for approximately three days before ransomware deployment in the observed Sinobi engagement.

Q2 2026 recorded 1,988 ransomware attack claims from 89 groups across 101 countries.

The US accounted for 42.5% of ransomware claims, Canada for 5% and Germany for 4.8%.

In the past 12 months, 27% of organizations reported data breaches tied to AI use.

Sensitive information disclosure ranks as the second biggest LLM threat for a second consecutive year.

11% of reported cybercrime cases in Africa in 2025 involved data breaches.

The global breach average is $4.99 million.

AI-enabled malicious breaches increased by 56% over the previous year.

Financial services breaches cost on average $6.3 million.

73% of organizations have found their workforce’s credentials in breach, Dark Web, or infostealer data in the past year

Nearly 693,000 records are known to have been breached in the confirmed education-sector ransomware attacks in H1 2026.

Only 24% of H1 2026 breach notices contained attack-vector details, the lowest rate ever recorded by the ITRC.

A single Canvas data compromise generated an estimated 275 million victim notices, accounting for 58% of the H1 2026 total.

Financial services recorded the highest frequency of compromises by sector at 387.

77% of enterprises are concerned about data breaches or theft in non-production environments.

68% of enterprises are concerned about data leaks in AI workflows.

Stealer log exposure increased 175% in a before-and-after security posture comparison.

34% of enterprise leaders report their organizations have experienced data breaches or theft.