Ransomware 2026: Data Theft Up 275%, Executives Targeted

The most important finding for boards and CISOs is who attackers are choosing. According to the report, 62 percent of victims were manager-level titles or above, which Zscaler frames as a deliberate focus on employees with privileged access and business influence. Executives hold the keys to financial approvals, sensitive contracts and strategic documents, so one compromised account can open far more doors than an entry-level one.

The second challenge is the toolset. Zscaler reports that threat actors increasingly abuse trusted workplace tools, including Microsoft Teams and Quick Assist, for social engineering, lateral movement, data theft and file encryption. A fake IT support call over Teams that persuades an executive to start a remote session looks like normal business activity to many defenses. The attacker never needs to break in, because the user opens the door.

Script-based tooling adds to the difficulty. JavaScript, PowerShell and Python let attackers build tools quickly and blend into legitimate activity, while generative AI speeds up reconnaissance, phishing text and tool development. The report also notes that manufacturing and technology remain the most targeted sectors, with freight and logistics (up 725 percent) and utilities (up 622 percent) growing fastest, and that the United States accounts for 50.7 percent of observed activity.

Put together, the picture is clear. Attackers need fewer exploits and more conversations, and they aim at the people whose accounts reach the most data. Defenses that rely on perimeter blocking and nightly backups leave a large gap.

A modern extortion attack follows a predictable chain, and each step is a chance to stop it. Understanding the chain helps you decide where to place controls.

1. Initial access. The attacker gains a foothold through a phishing message, a stolen credential, a vulnerable internet-facing device or a social-engineering call. Executive and manager accounts are favored targets.

2. Abuse of trusted tools. Instead of deploying obvious malware, the attacker uses tools already allowed in the environment, such as Teams chat, Quick Assist or built-in scripting engines. This keeps the intrusion quiet.

3. Lateral movement and discovery. The attacker maps file shares, cloud storage and mailboxes, looking for intellectual property, customer data and financial records.

4. Staging and exfiltration. Data is collected and sent out, sometimes in volumes measured in gigabytes or terabytes. This is the step that Zscaler's lede emphasizes, because stolen data is what drives extortion even when nothing is encrypted.

5. Extortion. The victim receives a demand, often with proof of the stolen files and a threat to publish them. Some groups still encrypt systems as well, which doubles the pressure.

The practical lesson comes from Zscaler's own guidance: reduce initial access opportunities, limit lateral movement and prevent data exfiltration. A SOC with SIEM correlation and MDR watches for the behaviors in steps 2 to 4, such as unusual remote-assistance sessions, mass file access and large outbound transfers, and can contain a compromised account before step 5.

Shifting your defense toward data protection reduces the loss that backups cannot recover. The benefits show up in several places.

Lower extortion leverage. If outbound data transfers are monitored and controlled, attackers cannot easily move large volumes out of the network. With less stolen data, a leak threat carries less weight.

Faster detection of privileged-account abuse. Behavioral monitoring on executive and administrator accounts catches the anomalies that signature-based tools miss, such as a manager account suddenly reading thousands of files at night.

Safer collaboration. Locking down who can start remote-assistance sessions and which external contacts can message your staff in Teams removes a favorite social-engineering path. HIT's Microsoft Teams Direct Routing and telephony services help companies keep calling and collaboration under clear, governed controls.

Resilient recovery. Immutable, tested cloud backup remains essential for the encryption half of the threat. HIT's IT managed services and cloud backup cover recovery objectives so that restoring operations is fast and predictable.

Regulatory and reputational protection. Many jurisdictions in Latin America, the US and Europe require notification when personal data is stolen, regardless of whether systems were encrypted. Preventing exfiltration lowers both the legal exposure and the customer-trust damage.

Because the average payment is around $432,000 in Zscaler's data, and downtime, legal work and lost customer trust come on top of any payment, prevention is usually the cheaper path.

HIT Communications brings more than 30 years of enterprise telecom and IT experience across Latin America, the US and Europe, and combines connectivity, collaboration and security under one accountable partner. That matters for this threat, because data theft crosses all three: the network the data travels on, the collaboration tools attackers abuse and the endpoints and cloud services where the data lives.

Our cybersecurity practice provides 24/7 SOC monitoring, SIEM, managed detection and response, and zero trust guidance, with a focus on privileged accounts and outbound data flows. Our Microsoft Teams services help you govern external access and telephony, and our IT managed services deliver backup, patching and cloud operations that support fast recovery.

A typical engagement starts with a short assessment: which executive and administrator accounts hold the most access, which remote-assistance tools are allowed, where sensitive data sits and how quickly large outbound transfers would be noticed. From there we prioritize controls by risk and monitor them continuously, in English, Spanish or Portuguese, so your regional teams get support in their own language and time zone.

The 2026 numbers show that ransomware is now as much a data-theft business as an encryption business. With data theft up more than 275 percent, 62 percent of victims at manager level or above, and attackers hiding inside tools like Teams and Quick Assist, the old model of perimeter blocking plus backups is no longer enough.

Three actions can start this week. First, review who can launch remote-assistance sessions and who can message your employees from outside the company in Teams. Second, add monitoring for executive and administrator accounts and for large outbound data transfers. Third, test your recovery and your incident response plan against a scenario where the data is stolen but nothing is encrypted.

If you would like an independent view of your exposure, contact the HIT Communications team and we will help you turn these findings into a practical, prioritized plan.