AI-Powered Breach Analysis Extends Data Exposure Across Supply Chains
Stolen data now travels farther than the breach that exposed it. Lab 1’s 2026 analysis found a median of 542 organizations affected beyond the initially breached victim, up from 482 the year before. AI tools that scan and connect information across stolen files are helping criminals turn third-party exposure into a wider source of fraud and follow-on attacks.
More data, more organizations at risk
Lab 1’s 2026 Anatomy of a Breach Report examined 328 million files across 2,089 breached datasets published online after incidents including ransomware extortion attacks. The dataset came from “ransomware and data-breach incidents in the public domain, reconstructed from forensic acquisitions of compromised systems,” the company said.
The median breach grew to 29.8GB and 32,734 files. That’s a 122% increase in data volume from 13.44GB in 2025, and a 45% rise in file count from 22,647. Across incidents from 2025 to 2026, Lab 1 identified 13,436 organizations exposed through breaches affecting other entities.
That spread reflects how much sensitive information businesses hold about clients, suppliers, partners, and users. Contracts, email threads, credentials, and personal profiles can reveal relationships and vulnerabilities that criminals use to select new targets. The initial victim may be only one entry point into a much broader network.
“Lab 1’s numbers line up with what we’re seeing,” says Ricardo Amper, founder and CEO of identity verification vendor Incode Technologies. AI has changed the economics of searching stolen data, he says: “So every file now gets read, cross-referenced, and turned into a target list.” Follow-on fraud can then reach suppliers, customers, and partners named in the files.
Financial, HR, and key exposure
Lab 1 used AI agents to inspect exposed files, including unstructured documents such as emails and PDFs. Of the 328 million files analyzed, about 145 million, or 44%, contained financial information such as bank details, tax identifiers, and invoices.
Another 29 million files, or 9%, contained HR material, including payroll records, employment contracts, and identity documents. Those records can support more convincing business email compromise and other social engineering schemes. Private cryptographic keys appeared in roughly 15% of the incidents.
The mix matters. Financial and identity records can enable direct fraud, while HR data and correspondence can give attackers enough context to impersonate employees or trusted contacts. Exposed keys can also create a path to systems and accounts.
Criminal services turn stolen files into intelligence
Lab 1 Threat Intelligence identified seven threat actor groups conducting structured analysis of breached data. The more advanced groups are using AI to index files and offering that capability to other criminals as a service, according to the report. The first such indexing service appeared in March 2026.
The platform reportedly sorts documents into categories, maps relationships, flags damaging material, estimates legal and regulatory exposure, and calculates suggested ransom demands. Lab 1 says intelligence offered through these services has included “share-buyback information for market manipulation, correspondence with sanctioned entities for use in ransomware negotiations, and security reports that could support follow-on attacks.”
Threat actor group FulcrumSec claimed it acquired an archive of 400,000 emails, then singled out 61 messages about engagements with US-sanctioned entities to pressure its victim on regulatory and reputational grounds. The group also claimed it used AI agents to search 700,717 files and find 11,500 patient records tied to named clinical trials.
“Historically, the sheer amount of time required to sift through breached datasets and the expertise needed to spot compromising information has held back the weaponization of data breaches,” says Robin Brattel, Lab 1 co-founder and CEO. AI and criminal indexing services, he says, are removing those barriers. Zero Networks CEO Benny Lakunishok makes a similar point: information that once took weeks to analyze can now reveal credentials, business relationships, and targets in minutes.
Third-party data needs active oversight
For security leaders, the practical challenge is tracking sensitive information held across the supply chain. Credentials and keys can be rotated or revoked, Brattel says, but invoices, contracts, supplier relationships, and internal communications may remain useful to attackers for years.
CISOs should know which suppliers hold information about their organization and establish rapid breach notification with those providers, Brattel advises. A third-party incident can expose an organization even when its own systems remain untouched, and the stolen material can continue to fuel targeting long after the original breach.
