Zscaler’s New Ransomware Report Puts Data Theft at the Centre

Zscaler released its 2026 ThreatLabz ransomware findings on September 30, reporting 896.2 terabytes of stolen data and more than 275% year-over-year growth in data exfiltration. The company's release describes a threat picture in which attackers use stolen information to increase their leverage over victims.

The percentage needs careful reading. It refers to the volume of data theft reported in the study, rather than proving that the number of ransomware incidents increased by the same amount. A dramatic headline about growth becomes less useful if readers cannot tell what was counted.

New findings about an earlier observation period

The report examines activity from April 2025 through March 2026 using Zscaler telemetry and ThreatLabz analysis. The release also reports $328 million in blockchain transactions associated with ransomware payments and says manager-level titles and above represented 62% of victims in the attacks it examined.

Those figures describe the vendor's observations and methodology. They are not a complete census of global incidents, and the publication date should not be confused with the dates of the attacks. GlobalTechRanks has not independently reproduced the dataset.

Recovery needs to include confidentiality

Our reading of the findings is that organisations should evaluate two separate consequences of a compromise: losing the ability to operate and losing control of information. A backup can be useful in recovering operations while leaving the second problem unresolved.

Consider a hypothetical business that restores its systems successfully after an intrusion. If an attacker has already copied customer records or product designs, restoration does not withdraw those copies. Incident decisions then depend on what was accessed, what left the environment and how confidently the business can establish that sequence.

This is why a ransomware exercise should include a scenario in which files remain usable. A team could ask what evidence would reveal unusual access to sensitive repositories, who would investigate it and which logs would still be available if an administrator account had been compromised. These are editorial planning suggestions, rather than controls that the report proves will prevent every attack.

Senior access deserves a distinct review

The reported concentration among people with managerial titles also suggests a question for security leaders: are permissions based on the work a person needs to perform, or on their organisational status? Reviewing that question can be more productive than assuming a familiar employee or a trusted collaboration tool makes a request legitimate.

Businesses should assess how sensitive actions are authorised and how an employee can verify an unexpected request through a separate established channel. Any changes need to fit the organisation's environment and be checked by its security team.

The new report is useful because it sharpens the distinction between operational disruption and theft-driven extortion. Its measurements should be read within their scope. The wider decision for defenders is whether their incident preparation can establish what happened to the data, even when the computers continue to work.

Image: Zscaler