Why this matters: ransomware gangs stopped just locking your files — now they steal nearly 900 terabytes of data a year and use AI to pick their victims.
September 30, 2026 — Ransomware attackers stole 896.2 terabytes of data over the past year — a 275% surge — while increasingly using generative AI to speed up operations and deliberately targeting senior executives, according to the Zscaler ThreatLabz 2026 Ransomware Report released today. The findings describe an extortion economy that has shifted from encrypting files to quietly siphoning off companies' most sensitive data.
Image: illustration of a hooded cybercriminal surrounded by ransomware lock icons facing a glowing digital defense shield. Credit: Red Eye Eagle News / original AI illustration.
Editor's Highlight: The ransomware business model has flipped: encryption was noisy and recoverable — data theft is silent, and you can never get the data back.
Table of Contents
- Key Facts
- The 275% Surge in Data Theft
- AI as the Attackers' Accelerator
- Executives in the Crosshairs
- Trusted Tools Turned Into Weapons
- A Fragmenting Criminal Ecosystem
- Bottom Line
- FAQ
- Sources
Key Facts
| Detail | Information |
|---|---|
| Report | Zscaler ThreatLabz 2026 Ransomware Report, released September 30, 2026 |
| Data theft | 896.2 TB exfiltrated — up more than 275% year over year (≈90x the Library of Congress print collection) |
| Ransom payments | $328M in blockchain transactions; average payment $431,995 (up 5.3%) |
| Executive targeting | Manager-level titles and above accounted for 62% of victims |
| AI's role | GenAI used to accelerate operations, per Zscaler — an accelerator, not a replacement for established techniques |
| Top target | United States: 50.7% of observed activity (Canada 4.8%, Germany 4.3%, UK 4.1%) |
| Victim count | 7,366 victims listed on ransomware leak sites — only 3% below last year |
| Methodology | Zscaler telemetry and ThreatLabz analysis, April 2025 through March 2026 |
The 275% Surge in Data Theft
The headline number is stark: ransomware data theft increased more than 275% year over year, reaching 896.2 terabytes of exfiltrated data. Zscaler notes that is the equivalent of 90 times the print collection at the Library of Congress — stolen in a single year.
Blockchain transactions associated with ransomware payments reached $328 million, and the average ransom payment rose 5.3% to $431,995.
"Successful ransomware extortion is shifting away from file encryption that often causes business disruptions to less visible, but more damaging data theft attacks," said Deepen Desai, Zscaler's executive vice president of cybersecurity. "They are using GenAI to speed up operations, and focusing on stealing more of an organization's intellectual property, customer information, and other sensitive data to drive payment."
Newsroom Focus: This is a business-model insight disguised as a crime statistic. Encryption was always a flawed product: victims could restore from backups and walk away. Stolen data cannot be un-stolen — which gives attackers permanent leverage and explains why payments keep climbing even as fewer victims pay for decryption.
AI as the Attackers' Accelerator
Zscaler describes generative AI as an accelerator of ransomware operations rather than a replacement for established attack techniques, the Digital Watch Observatory noted in its coverage. Attackers are using AI to develop tooling faster and to blend in with legitimate activity — with script-based tooling in JavaScript, PowerShell, and Python playing a larger role.
The pattern mirrors what defenders are seeing across the threat landscape: AI has not invented new categories of attack so much as it has industrialized the existing ones — faster reconnaissance, more convincing phishing, quicker adaptation when defenses respond.
Tech Analysis: The asymmetry is the story. Defenders must be right everywhere, every time; attackers need AI to make them faster at one thing. Zscaler's framing — AI as accelerator, not revolution — is a useful corrective to both hype and complacency: the same playbook, running at machine speed.
Executives in the Crosshairs
Nearly two-thirds of victims held manager-level titles or above — 62%, according to the report — highlighting a deliberate focus on employees with privileged roles and business influence.
The logic is straightforward: executives have broader access to sensitive systems, authority to approve payments, and personal reputations that make leak-site exposure especially costly. A stolen inbox belonging to a CFO is worth more than a thousand encrypted workstations.
Trusted Tools Turned Into Weapons
Threat actors are increasingly abusing trusted enterprise tools — including Microsoft Teams and Quick Assist — to enable social engineering, lateral movement, data theft, and file encryption, the report found.
This is the hardest trend for defenders to counter: when the attack arrives through the same collaboration software the company pays for, traditional perimeter defenses see nothing wrong. Desai's prescription — reducing initial access opportunities, limiting lateral movement, and preventing data exfiltration — amounts to assuming the attacker is already inside.
A Fragmenting Criminal Ecosystem
| Signal | What the report found |
|---|---|
| Victim volume | 7,366 victims on leak sites — persistent, down only 3% year over year |
| Top groups | Qilin, Akira, and INC Ransom accounted for 34% of disclosed victims |
| New entrants | 52 newly active groups identified; 9 of the top 15 groups are new to the rankings |
| Fastest-growing targets | Freight & logistics (+725%), utilities (+622%); manufacturing and technology remain most-targeted |
| Geography | U.S. organizations: 50.7% of observed activity — more than 10x the next country |
Analysis Note: The churn is as important as the totals. Fifty-two new groups in a year means takedowns are not shrinking the ecosystem — they are franchising it. Every disrupted gang splinters into affiliates who rebrand and return, which is why victim counts barely budge no matter how many operations law enforcement announces.
Practical Takeaway: For security teams, the report's guidance is blunt: stop these attacks early — cut initial access, contain lateral movement, and block exfiltration before it starts. Backups alone no longer neutralize ransomware, because the attackers are not really selling decryption anymore. They are selling silence.
Bottom Line
Ransomware grew up: less smash-and-grab encryption, more silent, AI-accelerated data theft aimed at the C-suite. Watch whether the freight, logistics, and utilities sectors — the fastest-growing targets — harden before they become the next headline breach.
FAQ
What did the Zscaler ThreatLabz 2026 Ransomware Report find?
Released September 30, 2026, it found ransomware data theft up more than 275% year over year to 896.2 terabytes, $328 million in ransom-linked blockchain transactions, and attackers increasingly using generative AI while targeting senior executives.
Why are attackers shifting from encryption to data theft?
According to Zscaler's Deepen Desai, data theft is "less visible, but more damaging" — stolen intellectual property and customer data gives attackers lasting leverage, since victims cannot restore stolen data from backups.
How is AI changing ransomware?
Zscaler describes generative AI as an accelerator: attackers use it to speed up operations, develop tooling faster with scripting languages, and blend in with legitimate activity — rather than inventing entirely new attack types.
Who is being targeted most?
Managers and above made up 62% of victims. Manufacturing and technology remain the most-targeted industries, while freight & logistics (+725%) and utilities (+622%) grew fastest. The U.S. accounts for 50.7% of observed activity.
What should companies do?
Zscaler advises stopping attacks early: reduce initial access opportunities, limit lateral movement inside the network, and prevent data exfiltration — because backups alone no longer defeat data-theft extortion.
Sources
- https://www.globenewswire.com/news-release/2026/09/30/3371551/0/en/new-zscaler-report-reveals-ai-assisted-attackers-move-to-massive-data-theft-executive-targeting-and-millions-in-extortion-payments.html — Zscaler, Inc. via GlobeNewswire, Sept 30, 2026: official release with all key findings, Desai quotes, and methodology
- https://dig.watch/updates/zscaler-threatlabz-2026-ransomware-report-275 — Digital Watch Observatory, Sept 30, 2026: independent analysis framing GenAI as an accelerator of existing techniques
- https://nationalcybersecurity.com/new-zscaler-report-reveals-ai-assisted-attackers-move-to-massive-data-theft-executive-targeting-and-millions-in-extortion-payments-hacking-cybersecurity-infosec-comptia-pentest-ran/ — National Cyber Security, Sept 30, 2026: full findings recap with sector and geography breakdowns
Join the conversation
Comments
Post a Comment