When a company suffers a data breach, it rarely suffers alone. According to the second edition of The Anatomy of a Breach, published by London-based data intelligence firm Lab 1, the median breach in 2026 has exposed information belonging to 542 organisations beyond the one that was actually compromised. Across the incidents analysed, 13,436 unique organisations were found to have had data exposed between 2025 and 2026.
The report draws on an analysis of 328 million unstructured files across 2,089 data breach incidents. Its findings describe not just a volume problem but a content problem, with specific implications for how cyber risk is assessed and priced.
Of the 328 million files analysed, approximately 145 million (44%) were classified as financial data, including banking details, tax identifiers and invoicing information. A further 9% were HR files containing payroll records, employment contracts and identity documents. Both categories appear in 95% and 84% of incidents respectively, according to the report.
Technical artefacts buried within large datasets carry risks that are less immediately obvious. Cryptographic private keys were present in approximately 15% of incidents analysed. Their presence can enable an attacker to bypass authentication, move laterally through a network and reach systems well beyond the original point of entry.
Lab 1’s findings include insurance documents as a distinct category within the criminal indexing service Leak Bazaar, which launched in March 2026. The service, operated by the threat actor known as “Snow” / “SnowTeam” on TierOne, a Russian-language cybercrime forum specialising in ransomware, reorganises stolen corporate data into 16 buyer-specific product categories. Insurance documents sit alongside financial records, M&A files and sanctions lists as a named product, with the stated risk being coverage-gap exploitation and policy fraud.
The insurance sector’s blast radius - the median number of organisations exposed when an insurance company is the named breach victim - stands at 727, well above the cross-sector median of 542. That figure reflects the volume of client, counterparty and supplier data that the sector routinely holds.
The sharper development in the 2026 report is not what is being stolen, but what is being done with it. The number of threat actor groups conducting structured, systematic analysis of breached datasets has risen from one in 2024 to seven by mid-2026, according to Lab 1’s threat intelligence team.
Those groups are using a range of tools. Basic scripted extraction has been in use for years, but human analyst teams, AI-assisted review and third-party indexing services are now widening access to methods that were previously limited to the most capable criminal groups.
Lab 1 documents one threat actor, FulcrumSec, claiming to have deployed AI agents across 700,717 files to identify patient records, proprietary compound structures and private AI models. FulcrumSec has been linked to incidents, including the targeting of Manchester Airports Group and pharmaceutical and biotech firm Novo Nordisk. The group also claimed to have isolated 61 emails with specific regulatory exposure from an archive of nearly 400,000 files, using them as targeted leverage against the victim.
The report describes this shift as the shrinking of the “weaponisation tax,” which is the time and effort historically required to turn a raw data dump into usable criminal intelligence. As that cost falls, the report argues, the potential payoff from a given breach rises, and more organisations in the chain of exposure face downstream risk.
That dynamic sits at the centre of how cyber underwriting is evolving in the UK market. Data from Allianz Commercial showed that data theft accounted for 40% of the value of large cyber claims in the first half of 2025, up from 25% across the whole of 2024, a sign that insurers are already absorbing the cost of more aggressive post-breach exploitation.
More than half of UK brokers identified cyber as the commercial product with the greatest growth potential in a 2025 GlobalData survey of 250 brokers, but the Lab 1 data points to a risk environment in which third-party and supply chain exposures are becoming harder to contain at the policy level alone.
Breach severity, the report contends, cannot be reliably measured by file volume or the identity of the named victim. A relatively small email archive can represent greater criminal value than a far larger dataset of lower-sensitivity records. And data stolen from one organisation, such as a technology platform, a compliance vendor, or an HR software provider, routinely implicates hundreds of others.
“Criminal techniques to analyse breached datasets are maturing monthly,” said Robin Brattel, co-founder and chief executive of Lab 1. “Today’s cutting edge of AI and indexing-as-a-service is going to be tomorrow’s commodity criminal approach.”
Lab 1’s recommendation is that organisations shift from volume-based breach response to content-aware assessment: understanding what data was exposed, who else it implicates, and how quickly it could be turned into actionable criminal intelligence.
