The median blast radius of data breaches has increased year-on-year at the same time cybercriminals have begun using AI to mine stolen datasets for damaging information that enables follow-on fraud and cyberattacks.
In 2026, the median breach exposed 542 organizations beyond the initially breached victim, according to a study by exposed data intelligence platform Lab 1. This compares to the median blast radius of a breach affecting 482 organizations last year.
Breach impact spreads across supply chains
Lab 1’s 2026 Anatomy of a Breach Report offers content-level analysis of stolen datasets — covering 328 million exposed files across 2,089 breached datasets — dumped online following data breaches such as ransomware extortion attacks.
Larger breaches leaking more files and data give criminals substantially more material to exploit for fraud, extortion, and follow-on attacks, according to Lab 1.
The median data breach size rose to 29.8GB of data (up 122% from 13.44GB in 2025) and 32,734 files (up 45% from 22,647).
Lab 1 said the dataset is drawn from “ransomware and data-breach incidents in the public domain, reconstructed from forensic acquisitions of compromised systems.”
Many businesses sit at the center of highly interconnected supply chains and hold data for extensive networks of clients, partners, users, and suppliers. Data stolen from such companies, including contracts, correspondence, and the like, can have follow-on impact on companies throughout their supply chains, as cybercriminals comb through the troves for compromising details, credentials, and profile information for further targeting.
In all, Lab 1 found 13,436 unique organizations were exposed through incidents occurring between 2025 and 2026.
Security experts see Lab 1’s blast radius numbers credible if not conservative.
“Lab 1’s numbers line up with what we’re seeing,” says Ricardo Amper, founder and CEO of identity verification vendor Incode Technologies. “A stolen dataset used to sit on a forum until someone had the time to dig through it, but AI removed that bottleneck.”
Amper adds: “So every file now gets read, cross-referenced, and turned into a target list. The blast radius keeps widening as the follow-on fraud lands on the suppliers, customers, and partners named inside the files.”
Content-level analysis of stolen datasets
For its study, Lab 1 deployed AI agents to inspect breached datasets and analyze all exposed files, including unstructured material such as emails and PDFs.
Of the 328 million breached files analyzed, approximately 145 million (44%) contain financial data, including banking details, tax identifiers, and invoicing information that can fuel fraud.
A further 29 million files (9%) contain HR data, including payroll records, employment contracts, and identity documents that can be used to run more convincing business email compromise or similar social engineering scams.
Even worse, private cryptographic keys appeared in approximately 15% of incidents.
The rise of breach indexing-as-a-service
Lab 1 Threat Intelligence has also identified seven threat actor groups that are conducting structured analysis of breached data. The most advanced groups are using AI to index breached datasets and are selling these capabilities to other criminals as a service, according to Lab 1.
The first indexing-as-a-service offering for cyber criminals, designed to sort breached data into categories that can be monetized, emerged in March 2026.
The platform supposedly classifies stolen documents, maps relationships, identifies damaging files, estimates legal and regulatory exposure, and calculates “optimal” ransom demands, among other functions.
The illicit intel offered through the sketchy services included “share-buyback information for market manipulation, correspondence with sanctioned entities for use in ransomware negotiations, and security reports that could support follow-on attacks,” according to Lab 1.
Threat actor group FulcrumSec claimed to have taken a 400,000-email archive before isolating 61 email files related to engagements with US-sanctioned entities for targeted regulatory and reputational leverage over the victim.
The same group claimed to deploy AI agents to mine 700,717 breached files to source 11,500 patient records across named clinical trials.
‘Weaponizing’ breached datasets
“Historically, the sheer amount of time required to sift through breached datasets and the expertise needed to spot compromising information has held back the weaponization of data breaches,” says Robin Brattel, co-founder and CEO of Lab 1. “AI and criminal indexing services are removing those barriers.”
Brattel adds: “That means a breach is no longer only a problem for the named victim: exposed financial, HR, and identity data will be searched, connected, and used for fraud, cyberattacks, and extortion against many other organizations.”
The real danger is when attackers turn that information into access and move from one system or organization to another, says Zero Networks CEO Benny Lakunishok.
“AI is making stolen data exponentially more valuable to criminals,” Lakunishok says. “What once took weeks to analyze can now be mined in minutes, revealing credentials, business relationships, and new targets”
Countermeasures
CISOs should pay much more attention to where “soft” data sits across their supply chain.
“Credentials and keys can be revoked or rotated; invoices, contracts, supplier relationships, and internal communications cannot,” Lab 1’s Brattel tells CSO. “Once exposed, that information can remain useful for years from the attacker point of view.”
In practice, CISOs should take for granted that third parties hold sensitive information about their organization, so that a third-party breach can always effectively become your exposure and that criminals may exploit that information long after the original incident.
“CISOs should know which suppliers hold their sensitive data and necessitate rapid notification when those suppliers are compromised,” Brattel advises.
