In recent years, the landscape of data breaches has shifted significantly, characterized by an alarming increase in the median blast radius of these incidents. A new study conducted by the exposed data intelligence platform Lab 1 highlights that, in 2026 alone, the median breach affected 542 organizations beyond the initial victim, marking a rise from 482 organizations in the previous year. This growing trend shows the expanding fallout of data breaches, indicating that the implications extend far beyond the entities that were directly compromised.
Lab 1’s comprehensive 2026 Anatomy of a Breach Report indicates that the impacts of these breaches are increasingly felt across interconnected supply chains. The report offers a detailed analysis of the nature of the stolen data, revealing that a staggering 328 million files were exposed across 2,089 breached datasets. This assortment of data often stems from cyber incidents such as ransomware extortion attacks, which have become increasingly prevalent in today’s digital environment.
As breaches scale, the volume of exposed data also intensifies, presenting cybercriminals with a wealth of material to exploit. The report notes a significant increase in the median data breach size, which jumped to 29.8GB—an increase of 122% from 2025, when it was 13.44GB. Similarly, the number of files compromised rose by 45%, from 22,647 to 32,734. This swelling of breach dimensions means that there is vastly more data available for criminals to manipulate for fraudulent purposes, extortion, and subsequent attacks.
Lab 1 clarifies that the dataset utilized for this analysis stems from forensic reconstructions of compromised systems within public domain ransomware and data-breach incidents. Given that many businesses function as nodes in highly interconnected supply chains, the data they hold often encompasses sensitive information related to extensive networks of clients, partners, and suppliers. Consequently, when such organizations fall victim to breaches, the implications ripple through their supply chains, exposing other entities to additional risks as cybercriminals sift through the datasets for exploitative opportunities.
As detailed in the study, over 13,436 unique organizations were exposed to incidents occurring between 2025 and 2026. Security experts corroborate Lab 1’s findings, suggesting that the reported blast radius numbers are credible, if not conservative. Ricardo Amper, CEO of identity verification firm Incode Technologies, observes that the traditional method of accessing stolen datasets has dramatically evolved. Previously, stolen datasets would remain dormant on forums until cybercriminals took the time to sift through them. However, the introduction of AI technologies has effectively eliminated this bottleneck, significantly expediting the exploitation process.
With each file now subjected to rapid analysis and cross-referencing, the ramifications of compromised data continue to broaden as fraud and subsequent attacks target not just the primary victims but also their suppliers, customers, and partners.
To carry out its research, Lab 1 employed AI agents to scrutinize the breached datasets extensively, analyzing various exposed files, including unstructured documents like emails and PDFs. Among the 328 million breached files studied, a notable portion—approximately 145 million—contained sensitive financial data such as banking details and tax identifiers. This information is highly attractive for fraudsters, who can leverage it to commit further criminal acts. Additionally, around 29 million files—about 9% of the total—contained HR data, including sensitive documents related to payroll and employment that can fuel social engineering scams such as business email compromises.
The situation is further exacerbated by the appearance of private cryptographic keys in roughly 15% of the incidents examined. These keys, if exploited, can open doors to even more insidious cyber threats.
Moreover, Lab 1’s analysis identifies seven advanced threat actor groups that are effectively providing a “breach indexing-as-a-service.” This service involves systematically analyzing breached data and offering it to other criminals looking to capitalize on the vulnerabilities. The first of such services emerged in March 2026, enabling cybercriminals to efficiently categorize stolen information. This platform not only classifies documents and maps relationships but also identifies files that are particularly damaging, estimates potential legal repercussions, and computes optimal ransom demands.
One notable incident involved the FulcrumSec threat actor group, which claimed to possess an archive of 400,000 emails. They isolated 61 files linked to engagements with US-sanctioned entities, using this sensitive data to exert regulatory and reputational pressure on the victim.
Historically, the enormity and complexity of analyzing breached datasets have restricted the weaponization of stolen information. Yet, with the rise of AI and sophisticated indexing services, these barriers have largely dissipated. As noted by Robin Brattel, co-founder and CEO of Lab 1, the implications of this newfound capability are profound. Breaches are no longer solely a concern for the initial victims; the financial, HR, and identity data exposed can be sought, connected, and weaponized against a multitude of organizations.
Benny Lakunishok, CEO of Zero Networks, underscores the danger of this situation by stating that AI has made stolen data exponentially more valuable. The once laborious process of analyzing such datasets has been transformed; what traditionally took weeks can now be refined into actionable intelligence in mere minutes.
Given this chilling reality, Chief Information Security Officers (CISOs) are urged to prioritize the management of sensitive “soft” data residing across their supply chains. Brattel emphasizes that while credentials and keys can be replaced, sensitive documents such as invoices and contracts cannot be as easily mitigated. Once such information is exposed, it retains its utility for attackers for years, making it a long-term threat to organizations.
To mitigate this risk effectively, CISOs must understand which suppliers handle sensitive data pertaining to their organizations and establish rapid notification protocols to respond to any breaches within those third parties. By being proactive in these matters, organizations can better prepare for the evolving landscape of data threats that continue to proliferate within the digital framework of today’s interconnected world.