Quorum Cyber’s Threat Intelligence (TI) team continually researches the cyber threat landscape and reports on its extensive findings twice a year. Based on its research during the first six months of the year, the team has named 2026 the year of exfiltration risk.
While traditional ransomware operations heavily rely on operational disruption by encrypting systems, impacting recovery, and forcing organisations into downtime-driven negotiations, cybercriminals have been changing their tactics this year. This is because encryption events can’t be completed quietly – they attract immediate attention from incident responders, law enforcement, and public scrutiny.
There’s a quieter way for threat actors to go about their business: data theft. And they can do it faster too, and scale it more easily without ringing unwanted alarm bells all at once.
For these reasons, our TI team believes that extortion-only operations are becoming more common in 2026. Threat groups are noticing that private sector, public sector and not-for-profit sector organisations fear public exposure, regulatory consequences, reputational damage, and customer notification requirements. All this is worse for them than the temporary operational disruption of data exfiltration.
Attackers are shifting their tactics to steal sensitive information rather than deploying ‘noisy’ ransomware payloads and attracting lots of unwanted attention. In turn, the primary risk has switched from “can the attacker get in?” to “what can the attacker remove once they have any form of trusted access?”
That access can come from a multitude of different sources, including a recruited insider, a compromised help desk workflow, an OAuth token, a malicious Software-as-a-Service (SaaS) integration, a CI/CD secret, a developer workstation, a remote access tool or an unsanctioned AI platform.
That’s not to say that ransomware isn’t used anymore, because some threat actors are still using this model, despite it increasing the risk of them getting caught. Affordable Ransomware as-a-Service (RaaS) kits are easily accessible for cybercrime groups, so RaaS remains a serious threat for organisations in every sector – but encryption is no longer the only technique that attackers are employing.
How best to defend against data exfiltration risk
As with other cyber threats, organisations are advised to treat data exfiltration prevention as a board-level cyber priority. This means understanding where sensitive data lives, who or what can access it, how it can be exported, and whether abnormal access can be detected quickly.
Data security should receive equal attention. Organisations need to know exactly where their critical data resides, who can access it, and how it can leave the organisation. We firmly believe that data classification, labelling, monitoring, and exfiltration detection capabilities should become board-level priorities as attackers increasingly focus on data theft rather than operational disruption.
There’s strong evidence that cybercriminals’ tactics are evolving. Exfiltration is now one of the defining cyber security challenges of 2026.
Access the 2026 Global Cyber Risk Mid-Year Review
Download the report to learn how to defend against data exfiltration and start your journey to greater cyber resilience.
Get in touch with us if you have any questions or concerns about the report’s content, or wish to talk to an expert about fortifying your cyber security.
You might also be interested in our complementary webinar, AI, Identity and Trust: Secure the Foundations of Cyber Resilience in 2026 on Tuesday 18th August at 11am ET / 4pm BST.
2026 Global Cyber Risk Mid-Year Review
The 2026 Global Cyber Risk Mid-Year Review describes the state of the global threat landscape and reveals that cybercriminals are increasingly adopting an extortion-led business model to monetise stolen data, identities, and cloud access rather than relying on ransomware and data encryption.
