Lab 1 says median breach now exposes 542 other organizations
Original title: The days of assuming another company’s breach is someone else’s problem are over
Across 2,089 datasets, median leak size rose to 29.8GB, and private keys appeared in about 15% of incidents.
Lab 1’s 2026 Anatomy of a Breach Report says the median breach exposed 542 organizations beyond the first victim, up from 482 a year earlier. The study covers 328 million files from 2,089 public ransomware and breach datasets, with median size rising to 29.8GB and 32,734 files. About 145 million files held financial data and 29 million held HR data. Lab 1 says seven groups now structure stolen data, and that the first criminal indexing-as-a-service appeared in March 2026.
Unconfirmed: Blast-radius statistics and FulcrumSec’s archive and patient-record figures are Lab 1 or group claims, not independently confirmed.
- Lab 1 counted 13,436 unique organizations exposed through 2025–2026 incidents.
- About 44% of analyzed files contained financial data and 9% contained HR data.
- FulcrumSec claims it isolated 61 emails tied to US-sanctioned entities from a 400,000-email archive.
- The same group claims AI mining of 700,717 files yielded 11,500 patient records.
- Threat actors
- FulcrumSec
- Organizations
- Lab 1
From the original article
4 min read at csoonline.com
The median blast radius of data breaches has increased year-on-year at the same time cybercriminals have begun using AI to mine stolen datasets for damaging information that enables follow-on fraud and cyberattacks. In 2026, the median breach exposed 542 organizations beyond the initially breached victim, according to a study by exposed data intelligence platform Lab 1.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.