{"id":10168,"date":"2026-10-27T08:25:00","date_gmt":"2026-10-27T08:25:00","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10168"},"modified":"2026-10-27T08:25:00","modified_gmt":"2026-10-27T08:25:00","slug":"the-days-of-assuming-another-companys-breach-is-someone-elses-problem-are-over","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10168","title":{"rendered":"The days of assuming another company\u2019s breach is someone else\u2019s problem are over"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

The median blast radius of data breaches has increased year-on-year at the same time cybercriminals have begun using AI to mine stolen datasets for damaging information that enables follow-on fraud and cyberattacks.<\/p>\n

In 2026, the median breach exposed 542 organizations beyond the initially breached victim, according to a study by exposed data intelligence platform Lab 1. This compares to the median blast radius of a breach affecting 482 organizations last year.<\/p>\n

Breach impact spreads across supply chains<\/h2>\n

Lab 1\u2019s 2026 Anatomy of a Breach Report<\/a> offers content-level analysis of stolen datasets \u2014 covering 328 million exposed files across 2,089 breached datasets \u2014 dumped online following data breaches such as ransomware<\/a> extortion attacks.<\/p>\n

Larger breaches leaking more files and data give criminals substantially more material to exploit for fraud, extortion, and follow-on attacks, according to Lab 1.<\/p>\n

The median data breach size rose to 29.8GB of data (up 122% from 13.44GB in 2025) and 32,734 files (up 45% from 22,647).<\/p>\n

Lab 1 said the dataset is drawn from \u201cransomware and data-breach incidents in the public domain, reconstructed from forensic acquisitions of compromised systems.\u201d<\/p>\n

Many businesses sit at the center of highly interconnected supply chains and hold data for extensive networks of clients, partners, users, and suppliers. Data stolen from such companies, including contracts, correspondence, and the like, can have follow-on impact on companies throughout their supply chains, as cybercriminals comb through the troves for compromising details, credentials, and profile information for further targeting.<\/p>\n

In all, Lab 1 found 13,436 unique organizations were exposed through incidents occurring between 2025 and 2026.<\/p>\n

Security experts see Lab 1\u2019s blast radius numbers credible if not conservative.<\/p>\n

\u201cLab 1\u2019s numbers line up with what we\u2019re seeing,\u201d says Ricardo Amper, founder and CEO of identity verification vendor Incode Technologies. \u201cA stolen dataset used to sit on a forum until someone had the time to dig through it, but AI removed that bottleneck.\u201d<\/p>\n

Amper adds: \u201cSo every file now gets read, cross-referenced, and turned into a target list. The blast radius keeps widening as the follow-on fraud lands on the suppliers, customers, and partners named inside the files.\u201d<\/p>\n

Content-level analysis of stolen datasets<\/h2>\n

For its study, Lab 1 deployed AI agents to inspect breached datasets and analyze all exposed files, including unstructured material such as emails and PDFs.<\/p>\n

Of the 328 million breached files analyzed, approximately 145 million (44%) contain financial data, including banking details, tax identifiers, and invoicing information that can fuel fraud.<\/p>\n

A further 29 million files (9%) contain HR data, including payroll records, employment contracts, and identity documents that can be used to run more convincing business email compromise<\/a> or similar social engineering scams.<\/p>\n

Even worse, private cryptographic keys appeared in approximately 15% of incidents.<\/p>\n

The rise of breach indexing-as-a-service<\/h2>\n

Lab 1 Threat Intelligence has also identified seven threat actor groups that are conducting structured analysis of breached data. The most advanced groups are using AI to index breached datasets and are selling these capabilities to other criminals as a service, according to Lab 1.<\/p>\n

The first indexing-as-a-service offering for cyber criminals, designed to sort breached data into categories that can be monetized, emerged in March 2026.<\/p>\n

The platform supposedly classifies stolen documents, maps relationships, identifies damaging files, estimates legal and regulatory exposure, and calculates \u201coptimal\u201d ransom demands, among other functions.<\/p>\n

The illicit intel offered through the sketchy services included \u201cshare-buyback information for market manipulation, correspondence with sanctioned entities for use in ransomware negotiations, and security reports that could support follow-on attacks,\u201d according to Lab 1.<\/p>\n

Threat actor group FulcrumSec<\/a> claimed to have taken a 400,000-email archive before isolating 61 email files related to engagements with US-sanctioned entities for targeted regulatory and reputational leverage over the victim.<\/p>\n

The same group claimed to deploy AI agents to mine 700,717 breached files to source 11,500 patient records across named clinical trials.<\/p>\n

\u2018Weaponizing\u2019 breached datasets<\/h2>\n

\u201cHistorically, the sheer amount of time required to sift through breached datasets and the expertise needed to spot compromising information has held back the weaponization of data breaches,\u201d says Robin Brattel, co-founder and CEO of Lab 1. \u201cAI and criminal indexing services are removing those barriers.\u201d<\/p>\n

Brattel adds: \u201cThat means a breach is no longer only a problem for the named victim: exposed financial, HR, and identity data will be searched, connected, and used for fraud, cyberattacks, and extortion against many other organizations.\u201d<\/p>\n

The real danger is when attackers turn that information into access and move from one system or organization to another, says Zero Networks CEO Benny Lakunishok.<\/p>\n

\u201cAI is making stolen data exponentially more valuable to criminals,\u201d Lakunishok says. \u201cWhat once took weeks to analyze can now be mined in minutes, revealing credentials, business relationships, and new targets\u201d<\/p>\n

Countermeasures<\/h2>\n

CISOs should pay much more attention to where \u201csoft\u201d data sits across their supply chain.<\/p>\n

\u201cCredentials and keys can be revoked or rotated; invoices, contracts, supplier relationships, and internal communications cannot,\u201d Lab 1\u2019s Brattel tells CSO. \u201cOnce exposed, that information can remain useful for years from the attacker point of view.\u201d<\/p>\n

In practice, CISOs should take for granted that third parties hold sensitive information about their organization, so that a third-party breach can always effectively become your exposure and that criminals may exploit that information long after the original incident.<\/p>\n

\u201cCISOs should know which suppliers hold their sensitive data and necessitate rapid notification when those suppliers are compromised,\u201d Brattel advises.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

The median blast radius of data breaches has increased year-on-year at the same time cybercriminals have begun using AI to mine stolen datasets for damaging information that enables follow-on fraud and cyberattacks. In 2026, the median breach exposed 542 organizations beyond the initially breached victim, according to a study by exposed data intelligence platform Lab […]<\/p>\n","protected":false},"author":0,"featured_media":10169,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10168","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10168"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10168"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10168\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10169"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10168"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10168"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10168"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}