Ransomware Data Theft Increases 275% Amid Falling Payments

• •Data theft from ransomware groups surged 275.8% in 2026, reaching 896.2 terabytes.
• •Ransom payments decreased by 15.8%, indicating a strategic shift in ransomware tactics.
• •In South Africa, 63% of ransomware incidents involved data encryption, with high recovery costs.

The Zscaler ThreatLabz 2026 Ransomware Report reveals a staggering 275.8% increase in data theft by the top ten ransomware groups, escalating from 123.8 terabytes to 896.2 terabytes year-over-year. Despite this surge, ransom payments have decreased by 15.8% to $327.8 million, indicating a shift in strategy where attackers leverage stolen data rather than solely relying on encryption. Schools, hospitals, and government agencies were notably affected, with one group reportedly exfiltrating 30 terabytes from a government target in a single campaign. In South Africa, a separate Sophos report indicates that 63% of ransomware incidents involved data encryption, with recovery costs averaging over R17 million. Although 99% of encrypted data was recovered, only 40% of organizations returned to normal operations within a week, the lowest among surveyed countries. The findings highlight the evolving tactics of ransomware operators and the challenges organizations face in recovery.