A new report, an earlier observation window
Zscaler released findings from its 2026 ThreatLabz ransomware report on September 30. Based on company telemetry and analysis covering April 2025 through March 2026, it reported 896.2 terabytes of stolen data, more than 275 percent above the preceding period. That figure describes data volume in its research, not a 275 percent increase in all ransomware incidents worldwide.
Read the measures separately
The company counted 7,366 victims listed on ransomware leak sites, a three percent annual decline in that measure. It identified manufacturing and technology as the most targeted sectors, with freight and logistics and utilities showing rapid growth. Leak-site listings and vendor observations are useful signals, but they are not a complete census of confirmed breaches. The report’s publication date should also not be confused with the end of its measurement period.
Restoration and exposure require different evidence
For a manufacturer, restoring production schedules and recovering engineering information are related responsibilities, but they answer different questions. A logistics business may resume dispatch while still investigating whether customer records left the network. A utility must similarly distinguish operational continuity from the scope of an information exposure. Our recommendation is to exercise both tracks: the team that restores service should not be expected to settle the data-loss question simply because backups worked.
Rehearse the decision before an extortion demand
A practical exercise starts with an explicit uncertainty: systems are recoverable, but the attacker claims to possess sensitive files. Ask who inventories the affected data, who can preserve transfer records, who communicates with customers and who approves outside incident-response help. Avoid assuming either that every criminal claim is true or that the absence of encryption means no serious incident occurred. MSP agreements should specify what logs are retained, how quickly they can be exported and who can authorize containment. Those questions turn a broad ransomware discussion into decisions the organization can actually rehearse. The goal is a recovery plan that accounts for service interruption and the unresolved consequences of theft.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
