By Hamza Faisal
Ransomware gangs stole nearly 900 terabytes of corporate data over the past year — a 275% jump driven by AI-assisted attacks, according to the Zscaler ThreatLabz 2026 Ransomware Report released Wednesday.
The report, published by cybersecurity firm Zscaler from San Jose, California, paints a picture of an industry that has industrialised data theft at terabyte scale.
Among the top 10 ransomware groups ranked by leaked data volume, combined exfiltration hit 896.2 terabytes — more than seven times the 123.8 terabytes recorded in the 2023–2024 reporting period, according to an independent analysis of the report.
That is roughly 90 times the print collection of the US Library of Congress, stolen in a single year.
Executives in the crosshairs
The report finds attackers are deliberately aiming at employees with privileged access. People holding manager-level titles and above accounted for 62% of victims in the attacks studied — nearly two-thirds of all targets.
Threat actors increasingly abuse trusted workplace tools, including Microsoft Teams, to steal data and move laterally inside corporate networks once they are in.
Generative AI is doing the heavy lifting. The researchers found attackers are using AI to accelerate every stage of their operations, from crafting lures to automating the exfiltration pipelines that move stolen data out of victim networks.
Ransomware economics shift
Blockchain transactions tied to ransomware payments reached $328 million over the reporting period. The average ransom payment climbed 5.3% year over year to $431,995.
But the economics are shifting: total known ransom payments fell year over year even as the average payment rose — a sign that attackers are extracting more money from the victims that do pay, while focusing on fewer, higher-value targets.
The findings cover ransomware activity from April 2025 through March 2026, drawing on public leak-site data, ransomware samples, attack telemetry and blockchain intelligence analysed by Zscaler's ThreatLabz research team.
Terabytes are the new leverage
The central message of the report is that ransomware is no longer defined by victim counts. Even if the number of organisations hit stays flat, the extortion pressure keeps growing as long as gangs can walk out with multiple terabytes per target.
Analysts describe it as a leverage shift: initial access increasingly runs on repeatable playbooks that exploit trusted enterprise tools and trusted people, while the scale of theft gives attackers more negotiating power than ever.
Zscaler says the full report includes deeper breakdowns of ransomware targets by industry, country and employee profile, the groups to watch in 2027, and practical guidance for disrupting attacks across the attack lifecycle.
