Lab 1 warns breach data now exposes thousands more firms

Lab 1 has published a report analysing 328 million files from 2,089 datasets exposed after cyber attacks. It found that the median breach now exposes data linked to 542 organisations beyond the named victim.

The study also found that 13,436 unique organisations were exposed through incidents recorded between 2025 and 2026, underlining how stolen data can affect companies that were not the direct target of an intrusion.

The findings are based on what Lab 1 described as the largest published content-level review of stolen datasets posted online after breaches. The report examined files taken in attacks and assessed the types of information they contained, including material in emails, PDFs and other unstructured documents.

It found that 44% of the files reviewed, or about 145 million documents, contained financial information. This included banking details, tax identifiers, invoicing records and other documents that could be used in invoice fraud, payment redirection scams, impersonation and resale on criminal marketplaces.

A further 29 million files, or 9% of the total, contained human resources information. These records included personally identifiable information, payroll documents, employment contracts and identity papers, which could be used in phishing, synthetic identity fraud, deepfake material and voice-cloning attempts.

Less common but more sensitive forms of exposure also appeared in the data. Private cryptographic keys were found in about 15% of the incidents analysed, pointing to the risk of attackers using breach material to gain access to systems, bypass authentication controls and widen their reach inside affected organisations.

Supply-chain reach

The report argues that the effects of a breach often extend well beyond the organisation named in public reporting. For technology, information and internet companies, the median number of additional organisations exposed in breaches dating from 2022 onwards was 6,985, the highest among the sectors reviewed.

That pattern reflects the central role those businesses play in supply chains and data-sharing arrangements with customers, suppliers, users and partners. In a sample of 130 incidents linked to 17 groups that launched or set up new data-leak sites over a one-year period, Lab 1 identified about 950,000 organisational exposures, including roughly 71,000 supply-chain organisations.

The volume of breach material is also rising. Newly added incidents in the enlarged dataset had a median size of 29.8 GB, up 121.7% from 13.44 GB in the previous study, while the median number of files rose 44.5% to 32,734 from 22,647.

AI analysis

Lab 1 said threat actors are becoming more systematic in how they examine stolen data. It identified seven threat actor groups conducting structured analysis of breached data, compared with one in 2024.

The report described several cases in which criminal groups claimed to have used artificial intelligence tools to search and classify large collections of stolen documents. In one example, a group known as FulcrumSec said it had searched a 400,000-email archive and isolated 61 emails linked to engagements with US-sanctioned entities for use in pressure tactics against the victim.

In another example cited in the report, the same group claimed to have used AI agents to review 700,717 breached files and identify 11,500 patient records across named clinical trials, 41,144 proprietary compound structures, 32 private AI models and five undisclosed drug programmes.

Lab 1 also said it had observed what it described as the first indexing-as-a-service offering for cyber criminals, designed to sort stolen data into categories that can be monetised. Such services are marketed as a way to flag documents that could be relevant to insider trading, market manipulation, ransomware negotiations or further cyber attacks, the report said.

Robin Brattel, co-founder and chief executive officer of Lab 1, said the spread of AI-assisted analysis was lowering the barriers to exploiting stolen information at scale.

"Historically, the sheer amount of time required to sift through breached datasets and the expertise needed to spot compromising information has held back the weaponisation of data breaches. AI and criminal indexing services are removing those barriers. That means a breach is no longer only a problem for the named victim: exposed financial, HR and identity data will be searched, connected and used for fraud, cyber attacks and extortion against many other organisations," Brattel said.

He said the methods used by cyber criminal groups were changing quickly as these tools became more common.

"Criminal techniques to analyse breached datasets are maturing monthly. Today's cutting edge of AI and indexing-as-a-service is going to be tomorrow's commodity criminal approach. Businesses need to understand where their data can be accessed beyond their own systems and how criminals could take advantage, rather than assuming that another company's breach is someone else's problem," Brattel said.