Researchers recorded 896 terabytes taken between April 2025 and March 2026, while the number of victims named on leak sites fell.

 

What happened

Data stolen in ransomware attacks rose more than 275% over the year to March 2026, reaching 896.2 terabytes, Security Today reported on October 5, 2026, citing research based on one security company's network telemetry. Over the same period, researchers counted 7,366 victims named on ransomware leak sites, a 3% decline year on year, and identified 52 newly active groups. Blockchain transactions tied to ransom payments totalled $328 million, with the average payment rising 5.3% to $431,995. Employees holding manager-level titles and above accounted for 62% of victims, which the researchers read as attackers concentrating on people with privileged access and influence inside their organizations.

 

Going deeper

Those two figures move in opposite directions, and the gap is the part worth examining. Fewer organizations appeared publicly on leak sites while the volume of data taken rose sharply, which means either that groups are extracting far more from each victim, or that more victims are settling before their names are posted, or both. Leak site counts measure what operators choose to publish rather than what they stole. The targeting finding points the same way, since an attack directed at a department head or a director reaches more systems per compromised account than one aimed at general staff. Attackers were also found using trusted workplace software including Microsoft Teams and Quick Assist across several stages of an attack, covering the initial approach, movement between systems, data theft, and encryption.

 

What was said

Attackers focused on employees with privileged roles and abused tools such as Microsoft Teams, researchers wrote in findings covered by Security Today. The steepest growth in targeting came in freight and logistics, up 725%, and utilities, up 622%, while manufacturing and technology remained the most heavily targeted industries overall. US organizations accounted for just over half of observed activity at 50.7%.

 

In the know

A second measurement from a different source points the same direction. Data theft featured in 63% of intrusions investigated over the year to June 2026, alongside a 15.8% year-on-year increase in ransomware being detonated against enterprises, according to the Microsoft Digital Defense Report 2026. Microsoft's figures come from its own telemetry across a different customer base and a different reporting window, which makes the agreement between them more useful than either number alone. Its report also names identity as the primary control for defense, noting that 52.2% of intrusions using legitimate credentials went on to involve further credential theft.

 

The big picture

The payment figures behind this trend explain why groups would take more from each victim. Verizon recorded 69% of ransomware victims declining to pay in its latest dataset, with the median ransom falling to $139,875 from $150,000 the year before, while ransomware itself grew to 48% of all breaches, in its 2026 report. Groups facing more refusals and smaller payments have reason to extract more leverage per intrusion, which fits a picture of volume rising while published victim counts fall. For healthcare organizations the practical consequence sits in what gets planned for. Recovery planning measured in restoration time addresses encryption, and a negotiation that never happens still leaves the organization holding a breach determination, a notification population, and whatever the group chooses to publish months later.

 

FAQs

Why would leak site victim counts fall while data theft rises?

Operators post victims selectively, usually to apply pressure during a negotiation. A victim who pays before publication never appears, so the count reflects negotiating outcomes rather than the number of organizations attacked.

 

What does 896 terabytes represent?

The total volume researchers observed being removed from victim networks across the period, not the amount taken from any one organization. Volume figures say nothing about how many people the records describe or how sensitive the contents are.

 

Why target managers rather than system administrators?

Administrators are monitored closely and their accounts are usually protected with additional controls. Managers accumulate broad access to business systems, correspondence, and shared drives while attracting less scrutiny, and their requests carry authority with colleagues.

 

How is Quick Assist used in an attack?

It is a Windows feature for remote support, allowing one person to view and control another's screen with their permission. Attackers posing as IT support talk a target into granting that permission, which gives them hands-on access without any software being installed.

 

Does restoring from backup end a ransomware incident?

Any data removed before encryption remains with the attacker, so the organization still conducts a breach risk assessment, still faces publication, and still carries notification obligations if protected health information was involved.