The days of assuming another company’s breach is someone else’s problem are over

Source: CSO Online · OCT 27, 2026

The median blast radius of data breaches has increased year-on-year at the same time cybercriminals have begun using AI to mine stolen datasets for damaging information that enables follow-on fraud and cyberattacks. In 2026, the median breach exposed 542 organizations beyond the initially breached victim, according to a study by exposed data intelligence platform Lab 1. This compares to the median blast radius of a breach affecting 482 organizations last year. Breach impact spreads across supply chains Lab 1’s 2026 Anatomy of a Breach Report offers content-level analysis of stolen datasets — covering 328 million exposed files across 2,089 breached datasets — dumped online following data breaches such as ransomware extortion attacks. Larger breaches leaking more files and data give criminals substantially more material to exploit for fraud, extortion, and follow-on attacks, according to Lab 1. The median data breach size rose to 29.8GB of data (up 122% from 13.44GB in 2025) and 32,734 f