A company can be caught in a breach it never hears about. Lab 1, which sells an exposed-data intelligence platform, has published the second edition of The Anatomy of a Breach Report, covering 328 million exposed files across 2,089 breached datasets, and says the median breach this year exposes information belonging to 542 organisations beyond the named victim.
Breaches are also getting bigger. Median incident size in the expanded dataset rose to 29.8GB, up 121.7% from 13.44GB in the previous study, and median file count rose 44.5% to 32,734. For technology, information and internet companies the median across breaches since 2022 is 6,985 exposed organisations, the widest reach of any sector Lab 1 examined, because they hold data for large networks of clients, partners and suppliers.
What is in the files
Of the 328 million files, about 145 million (44%) contain financial data such as banking details, tax identifiers and invoicing information, and 29 million (9%) contain HR data including payroll records, contracts and identity documents. Cryptographic private keys appeared in around 15% of incidents. A sample of 130 incidents tied to 17 groups that set up data-leak sites between June 2025 and June 2026 contained around 950,000 organisational exposures, including about 71,000 supply-chain organisations.
Criminals add AI to the sorting
Lab 1 counts seven threat actor groups doing structured analysis of breached data now, against one in 2024. It reports that the group FulcrumSec claimed to pick 61 emails about engagements with US-sanctioned entities out of a 400,000-email archive, to use as regulatory and reputational leverage against the victim. The same group claimed to use AI agents to mine 700,717 files for 11,500 patient records across named clinical trials, among other material. Lab 1 also describes a criminal AI engine whose operators claim it can classify stolen documents and estimate legal exposure, and an indexing service, which it says appeared in March 2026, that sorts breached data into categories that can be sold.
Most of those descriptions rest on claims made by the criminals themselves, as reported by Lab 1. Robin Brattel, Lab 1's co-founder and chief executive, described what has changed.
“Historically, the sheer amount of time required to sift through breached datasets and the expertise needed to spot compromising information has held back the weaponisation of data breaches,” said Robin Brattel, Co-founder and CEO of Lab 1. He argued that AI and criminal indexing services are removing those barriers.
To stay across the latest in cloud, AI and enterprise tech analysis from Compare the Cloud, subscribe to our weekly newsletter at https://www.comparethecloud.net/newsletter
