Ransomware Data Theft Up 275%, Zscaler ThreatLabz Report Says

What the report found

Zscaler's ThreatLabz research team has published its 2026 Ransomware Report. Its headline number is a jump of more than 275% in ransomware activity over the past year. Attackers exfiltrated 896.2 terabytes of data during the period 1. A second account rounds that to "nearly 900 terabytes" 2. The report covers April 2025 through March 2026. It draws on telemetry from the Zscaler security cloud along with the company's own analysis 2.

Two other findings stand out alongside the volume figures. Attackers concentrated on people with elevated access. Executives or privileged roles were targeted in 62% of cases 2. Attackers also leaned on legitimate business software, and Microsoft Teams is named as one abused tool 1. ThreatLabz also says threat actors are using generative AI to move faster. It adds that the number of active ransomware groups and victims remains high 2.

What exactly rose 275%?

The two write-ups describe the central statistic differently. Security Today frames it as a 275% rise in ransomware data theft 1. ITdaily describes it as a 275% increase in ransomware attacks 2. These are not the same claim. A surge in stolen data could come from a modest rise in incidents, each involving larger exfiltrations. A surge in attacks would point to many more intrusions overall.

The data-theft reading appears to be the more precise one. It sits directly beside the terabyte figure, and it fits the report's own framing. ITdaily summarizes that framing as extortion revolving "less around visible encryption and more around data theft and pressure through publication" 2. Readers citing the figure should be careful about which metric they attach it to. Neither account provides the baseline from which the 275% is calculated.

Why the shift toward theft matters

The report points to a broader trend: ransomware without the ransomware. Classic attacks encrypted systems and demanded payment for a decryption key. That model is noisy and disruptive, and good backups weaken it. Stealing data and threatening to publish it gives attackers leverage even when a victim can restore its systems. It also tends to trip fewer alarms than mass file encryption.

If exfiltration is now the main lever, defenders need to rethink how they measure ransomware. Restore times and backup integrity still matter, but they do not address the core threat of sensitive data leaving the network. Outbound data monitoring, data loss prevention, and limiting what any single account can reach become more central. That is analysis rather than a finding stated in the report. Still, it follows from the direction ThreatLabz describes.

Zscaler sells cloud security and zero-trust products built around inspecting traffic and restricting access. Its conclusions line up with its commercial pitch. That does not invalidate the telemetry, but the findings are best read as one vendor's view from its own customer base, not a census of all ransomware activity.

Executives and trusted tools as the new front door

The focus on privileged users is the most practical takeaway. When 62% of cases involve executives or privileged roles 2, attackers are clearly going after accounts that offer the most access with the least effort. Compromising one well-placed user can open broad data stores. That shortens the path to the large exfiltration volumes the report records.

The abuse of tools like Microsoft Teams 1 reinforces the point. Collaboration platforms are trusted by default. Employees expect messages, file shares, and contact from colleagues or IT staff through them. That makes them effective channels for social engineering and for moving data in ways that look like normal business activity. Generative AI 2 likely adds to this. Convincing lures and faster operations reduce the cost of each attempt, though neither account details exactly how attackers are applying it.

The bottom line

Both accounts agree on the overall picture: more stolen data, attackers aiming higher in the org chart, and techniques that blend into everyday work tools 12. They differ on whether the 275% describes attacks or data theft. The weight of the report's own framing favors data theft.

The practical message for security teams is that ransomware defense is increasingly about data and identity, not just recovery. Protecting the accounts with the most access, scrutinizing activity on trusted collaboration platforms, and watching for unusual outbound transfers address the threat as it now operates. Backups remain necessary, but against an attacker whose main goal is to steal and publish, they are no longer sufficient on their own.