Zscaler 2026 Report: Ransomware Stole 896 TB, Up 275%

Forget everything you think you know about ransomware. The new crop of cybercriminals is not locking up your files and demanding Bitcoin to unscramble them. Instead, they are slipping in quietly, copying out enormous volumes of your organization's most valuable data, and charging you to keep it from going public. According to a major new report from Zscaler's ThreatLabz research team, data theft by ransomware crews surged more than 275% over the past year, reaching 896.2 terabytes of exfiltrated data — roughly 90 times the size of the Library of Congress's print collection in plain text, using the widely cited 10-terabyte estimate for that collection.

Update, Sept. 30: Zscaler's own five takeaways

Zscaler's own writeup of the report, published on its site this week, adds three details worth folding in. Among the top 10 ransomware groups by leaked-data volume, combined exfiltration rose 275.8% year over year to 896.2 TB — more than seven times the volume of the 2023–24 reporting period (123.8 TB). Roughly 75% of victims worked in finance, sales, operations, HR, and marketing — functions with data proximity, not just IT privilege. And while total known ransom payments fell year over year, the average payment rose, which Zscaler reads as attackers extracting more from the victims that do pay. That is Zscaler's interpretation, not independent fact — but it is consistent with the report's shift from locking files to stealing them.

The Zscaler ThreatLabz 2026 Ransomware Report, released Tuesday, is one of the year's most sweeping looks at the ransomware economy, drawing on the company's telemetry from April 2025 through March 2026. Its headline conclusion is blunt: encryption, the signature move of classic ransomware, is increasingly an afterthought. Data theft is the business now.

Server racks in a data center. Ransomware crews are shifting from locking up infrastructure like this to quietly siphoning data off of it. Photo: Wil Weterings (public domain), via Wikimedia Commons.

The big number: 896 terabytes walked out the door

The 896.2 terabytes of data that ransomware groups exfiltrated during the study period represents a 275% year-over-year increase, the report found. To put that in perspective, it is more than two terabytes of stolen corporate data every single day for a full year — intellectual property, customer records, financial documents, and the kind of material that can crater a stock price or trigger a regulatory investigation when it appears on a leak site.

This marks a fundamental shift in how ransomware extortion works. In the older model, attackers encrypted a victim's files and demanded payment for the decryption key — an act that was loud, disruptive, and gave defenders an obvious crisis to rally around. The newer model is quieter and, per the report, more damaging. "Successful ransomware extortion is shifting away from file encryption that often causes business disruptions to less visible, but more damaging data theft attacks," said Deepen Desai, executive vice president of cybersecurity at Zscaler. "They are using GenAI to speed up operations, and focusing on stealing more of an organization's intellectual property, customer information, and other sensitive data to drive payment."

The change in tactics has a practical logic behind it. Encrypting everything is slow, conspicuous, and — as corporate backup practices have improved — increasingly survivable. Organizations that can restore from clean backups do not need a decryption key. But nobody has a "backup" of stolen trade secrets or leaked customer databases. Once the data is in criminal hands, the leverage never expires. Victims pay not to recover operations, but to avoid the fallout of exposure.

Executives are the target now

One of the report's more striking findings: 62% of victims in these attacks hold manager-level titles or above. This is not random. Attackers are deliberately hunting the accounts of employees with privileged roles and business influence — people whose credentials open the most doors and whose inboxes contain the most valuable material.

The pattern makes the traditional security playbook look incomplete. Most corporate security training still emphasizes protecting rank-and-file employees from phishing links. But when attackers are specifically casing the org chart — identifying directors, VPs, and IT administrators, and then crafting social engineering campaigns around them — the threat concentrates where access is deepest. A single compromised executive account can yield more usable intelligence for extortion than a hundred workstation infections.

For a related look at how attackers are going after the enterprise network layer itself, see TechPulse USA's earlier report on the NetScaler zero-day attacks.

They're using your own tools against you

Perhaps the most unsettling detail in the report is how ordinary the attackers' toolkits have become. ThreatLabz found that threat actors are increasingly abusing trusted enterprise tools — including Microsoft Teams and Microsoft's Quick Assist remote-support utility — to carry out social engineering, move laterally through networks, steal data, and run file encryption.

This is a sophisticated evolution. Security products are tuned to flag unfamiliar malware and suspicious binaries, but a support session inside Quick Assist looks exactly like an IT administrator helping a colleague. A Teams call from a convincing impersonator sounds like a normal workday. By "living off the land" — operating inside software the victim already trusts — attackers bypass a whole layer of detection that organizations spent heavily to build.

The report also notes that script-based tooling is playing a larger role, with JavaScript, PowerShell, and Python helping attackers develop new tooling faster and blend in with legitimate administrative activity. And generative AI is accelerating everything: reconnaissance, phishing content, code, and operational planning. The same productivity gains GenAI brought to legitimate software teams are flowing directly into criminal operations.

The National Security Operations Center floor in 2012. Defenders at security operations centers now face attackers who weaponize trusted enterprise tools like Microsoft Teams and Quick Assist. Photo: National Security Agency (public domain), via Wikimedia Commons.

The economics: $328 million in crypto ransoms

Follow the money and the scale of the business becomes clear. Blockchain transactions tied to ransomware payments reached $328 million during the study period, according to ThreatLabz analysis. The average ransom payment climbed 5.3% year over year to $431,995.

That average masks an important dynamic. When extortion moves from "pay to unlock your files" to "pay or your customers' personal data goes public," the pricing power shifts to the attacker. The ransom is no longer benchmarked against the cost of downtime — it is benchmarked against the cost of a data-breach notification, regulatory fines, class-action lawsuits, and brand damage. Those costs are typically far larger, which helps explain why the average keeps creeping up even as defenders get better at the encryption-recovery game.

It is worth noting what the $328 million figure does not capture: unreported payments, payments routed through privacy coins or laundering services the analysts could not trace, and the broader economic damage of breaches — lost business, incident-response costs, legal fees. The true cost of ransomware in the United States last year is almost certainly much higher than what made it onto a blockchain ledger.

A fractured, fast-growing criminal ecosystem

The report paints a picture of a ransomware underworld that is simultaneously consolidating and fragmenting. The FBI's takedown of an alleged ShinyHunters leader — arrested in a Dutch raid — is a reminder that the other side is fighting back. ThreatLabz tracked 7,366 victims named on ransomware leak sites over the year — a slight 3% decline from the previous year, suggesting victim counts have plateaued while data volumes exploded. Three groups — Qilin, Akira, and INC Ransom — accounted for 34% of disclosed victims, concentrating a third of the visible market in a handful of brands.

Yet beneath that consolidation, churn is accelerating. Nine of the top 15 groups by victim volume were new to the rankings, and ThreatLabz identified 52 newly active groups over the year. This is the signature of the ransomware-as-a-service model: when one operation is dismantled or folds, its affiliates simply rebrand and sign up with a new crew. Taking down a group increasingly resembles cutting heads off a hydra — each removal creates room for newcomers.

The industry breakdown is also revealing. Manufacturing and technology remained the most targeted sectors, but the fastest year-over-year growth came in freight and logistics, up 725%, and utilities, up 622%. The surge in utilities targeting should set off alarm bells: attacks on power, water, and other critical infrastructure carry national-security implications far beyond any single company's balance sheet. For the national-security dimension, see how the Pentagon's own breach exposed 3 million military records. The logistics spike, meanwhile, suggests attackers are going after the supply chain itself — where a single breach can expose the data of thousands of downstream partners and customers.

The United States remains the prime target

American organizations bore the brunt of the activity. The United States accounted for 50.7% of observed ransomware activity, far ahead of Canada at 4.8%, Germany at 4.3%, and the United Kingdom at 4.1%. More than half of all observed attacks hit US companies and institutions — a reminder that American firms remain, by a wide margin, the most lucrative prey in the global ransomware economy.

Several factors explain the imbalance. The US has the deepest concentration of wealthy corporate targets, the most permissive environment for converting extorted cryptocurrency, and a patchwork regulatory landscape that can slow collective defense. But there is also a more basic explanation: familiarity. English-speaking criminal crews, many of them native English speakers using generative AI to polish their lures, find American corporate culture — and its collaboration tools — the easiest terrain to operate in.

What this means for US companies

Reading this report as a security leader, the message is less "buy another product" and more "rethink your assumptions." The 275% jump in data theft argues for a defense posture built around data itself: knowing what your most sensitive information is, where it lives, who can reach it, and whether anyone is watching it leave. Encryption-focused backup strategies, while still necessary, answer a question attackers have largely stopped asking.

The executive-targeting statistic argues for tiered security that actually tracks privilege rather than seniority titles — an IT administrator with domain credentials deserves more protection than a VP with a corner office. And the abuse of tools like Teams and Quick Assist argues for identity verification that does not collapse the moment someone sounds convincing on a call.

Desai's prescription is direct: "Security teams need to stop these attacks early by reducing initial access opportunities, limiting lateral movement, and preventing data exfiltration." Zero-trust architecture — never trusting a device or user by default, even inside the corporate network — is the framework the report points toward, which is unsurprising given that Zscaler (NASDAQ: ZS), the San Jose-based security firm behind the research, sells exactly that. Readers should weigh that commercial interest when reading the recommendations. But the underlying data — 896 terabytes of stolen information, $328 million in traced payments, and a criminal ecosystem adding dozens of new groups a year — stands on its own. Whatever vendors you choose, the ransomware business is not winding down. It is getting bigger, quieter, and better aimed.

Sources: Zscaler ThreatLabz 2026 Ransomware Report via GlobeNewswire press release (Sept. 30, 2026); Zscaler report landing page; National Cyber Security Consulting coverage of the report; The Manila Times coverage of the report. Library of Congress print-collection estimate via the Lyman & Varian study cited on Wikipedia.