Zscaler ThreatLabz report finds ransomware data theft up 275.8% year on year

Zscaler’s ThreatLabz unit has published its 2026 Ransomware Report, covering activity from April 2025 to March 2026. Among the top 10 ransomware groups by leak volume, combined exfiltration rose 275.8% year on year to 896.2 TB, more than seven times the 123.8 TB recorded in the 2023-2024 period.

The report says 62% of victims held manager-level titles or above, and roughly 75% worked in finance, sales, operations, HR or marketing. It also describes attackers combining spam bombing with Microsoft Teams vishing to steer victims towards legitimate remote support tools such as Quick Assist.

Publicly listed victims fell 3% year on year to 7,366, but 60% of the top 15 groups by victim volume were new to the rankings. Known payments dropped 15.8% to $327.8m while the average payment rose 5.3% to $431,995.