Attackers now steal data and extort rather than encrypt. They come in through suppliers and SaaS platforms more often, and they hit critical infrastructure. The fines that follow are rare, slow and lopsided. Meanwhile, money is moving out of ransom payments and into defence and incident response.
This edition draws on 93 logged incidents (90 malicious plus three systemic IT outages), regulator enforcement records and market data from 2023 to 2026. Year 3 has more rows than earlier years, so trend comparisons use shares or a like-for-like headline tier, never raw counts.
Ransomware was half of Year 1's malicious incidents but a fifth of Year 3's. Data theft followed by extortion has replaced it. The attackers often never encrypt anything, and 39% of Year 3 victims did not say how attackers got in. Across all breaches, ransomware is still rising: it featured in 48% of breaches in 2025, and 96% of ransomware victims whose size was known were small and medium-sized businesses (Verizon 2026 Data Breach Investigations Report). Ransomware has not gone away; it has moved down to firms too small to make a headline list.
Only 12 of 90 malicious incidents have a credible cost estimate. Their median is $347m. Change Healthcare ($3.1bn) and Jaguar Land Rover (about $2.5bn, the Cyber Monitoring Centre's estimate of the cost to the UK economy) make up 59% of the total. Operational disruption, not data loss, drives the biggest bills.
Only 23andMe (£2.31m, ICO) and Coupang (₩624.7bn, about $409m, Korea PIPC) have been fined so far. Across ten recent security fines, the median wait from breach to penalty is 31 months.
Two Korean penalties (Coupang and SK Telecom) make up 55% of the $678m in breach-security fines identified for Sep 2024–Aug 2026 (counting only the ₩423.6bn of Coupang's fine that was for the breach). Korea fines within months. The UK takes years and cuts its proposed fines by half or more. US federal enforcement has pulled back.
20 of 90 malicious incidents ran through a supplier, a SaaS platform or an open-source package. This peaked at 33% in Year 2, during the Snowflake and Salesforce waves. One compromised provider can expose hundreds of downstream customers. On a broader definition, Verizon counts third-party involvement in 48% of breaches, up 60% in a year (Verizon 2026 Data Breach Investigations Report).
Incidents attributed to a state went from 1 in Year 1 to 8 in Year 3. Year 3 brought destructive attacks on Polish energy and water systems, and an Iran-linked wiper attack that erased 200,000 devices at Stryker. In Europe, the Middle East and Africa, state-affiliated actors were behind 23% of breaches, against 14% worldwide (Verizon 2026 Data Breach Investigations Report).
FBI-reported cybercrime losses rose 67% between 2023 and 2025, while ransom payments fell by about a third (Chainalysis; the 2025 figure is provisional). Security spending is forecast to rise 24% from 2024 to 2026. Incident response is a $41–56bn market growing 16–21% a year.
Someone is always being hacked, and the market that cleans up afterwards is growing faster than the crime itself. Victims are refusing to pay ransoms; Coveware puts the share that paid at 23% in Q1 2026, and in Verizon's data 69% of ransomware victims did not pay in 2025, with the median ransom paid down to $139,875 (Verizon 2026 Data Breach Investigations Report). That pushes attackers towards data theft, and they pressure victims publicly instead. The costs now fall on recovery and lost revenue rather than on the ransom. For boards, the biggest exposures are a supplier failure, a social-engineered help desk and weeks of operational downtime. A regulator's fine comes a distant fourth.
Each theme is scored from 1 (low pressure) to 10 (severe), based on the indicators shown. An upward arrow means more risk pressure on organisations. These are first-edition baseline scores; the method section explains how they were set.
| Theme | Year 2 | Year 3 | Direction | What moved it |
|---|
Year 3 was compiled partly from monthly trackers, so it lists 53 incidents against 19 and 21 in Years 1 and 2. To compare the years fairly, we count only headline-tier incidents. These are confirmed, malicious, and either exposed at least 1m records, cost at least $10m, or were attributed to a nation-state. On that basis the count holds steady.
Each malicious incident is grouped by its primary entry route or technique. The shares are within each year, so Year 3's larger sample does not distort the picture.
The most expensive incidents are ones that stop a business from operating: claims processing, car dealerships, factory lines and store replenishment. A large data leak with no outage rarely produces a public cost estimate at all.
Known ransoms paid in the log: Caesars about $15m, Change Healthcare $22m, CDK about $25m, plus undisclosed payments by PowerSchool and Instructure. PowerSchool was extorted again after paying.
We searched for regulatory fines and regulator or state-attorney settlements linked to every logged incident, and to other large security-breach fines from 2024 to 2026. Fines for non-security matters such as data transfers or ad targeting (TikTok €530m, LinkedIn €310m, Uber €290m) are excluded.
Between September 2023 and August 2026, 117 laws and binding rules on cyber security, data protection and AI started to apply across 48 jurisdictions. Privacy laws arrived at a steady pace. Cyber-security rules peaked in Year 2, when the EU's NIS2 and DORA took effect. In Year 3, AI laws jumped from one a year to 11.
| Applies from | Where | Law | What changes | Incident reporting | Maximum penalty |
|---|---|---|---|---|---|
| 2023-12 | United States | SEC cyber disclosure rules | Listed companies must disclose material cyber incidents and describe board oversight of cyber risk. | 4 business days after deciding an incident is material | SEC enforcement |
| 2024-04 | United Kingdom | Product Security (PSTI) regime | World's first legal ban on default passwords in consumer connected devices. | — | £10m or 4% of worldwide revenue |
| 2024-09 | Saudi Arabia | Personal Data Protection Law | Full enforcement after a one-year grace period. | 72 hours | SAR 5m, doubled for repeat breaches |
| 2024-10 | European Union | NIS2 Directive | Cyber risk management at board level for firms in 18 critical sectors. | 24h warning, 72h notice, 1-month report | €10m or 2% of global turnover |
| 2024-10 | Indonesia | Personal Data Protection Law | Full application after a two-year transition. | 72 hours | 2% of annual revenue |
| 2025-01 | European Union | DORA | Banks, insurers and their critical IT suppliers must manage and test ICT resilience. | 4h after classification (max 24h) | Set nationally |
| 2025-02 | European Union | AI Act (first stage) | Banned AI practices; general-purpose AI rules from Aug 2025. High-risk rules pushed back to Dec 2027. | 15 days for serious incidents | €35m or 7% of global turnover |
| 2025-03 | Chile | Framework Law on Cybersecurity | Latin America's first comprehensive cyber law, with a national agency and CSIRT. | 3h early alert, 72h report | 40,000 UTM |
| 2025-05 | Australia | Cyber Security Act | Mandatory reporting of ransom payments by businesses with turnover of A$3m or more. | 72 hours after paying | 60 penalty units |
| 2025-11 | China | Cybersecurity incident reporting measures | Tight deadlines for all network operators. | 1 hour for critical infrastructure | RMB 10m (from 2026) |
| 2026-01 | Hong Kong | Critical Infrastructures (Computer Systems) Ordinance | Hong Kong's first critical-infrastructure cyber law. | 12 hours (serious) | HK$5m plus daily fines |
| 2026-01 | South Korea | AI Basic Act | The second comprehensive AI law after the EU's. | — | KRW 30m |
| 2026-02 | United Kingdom | Data (Use and Access) Act | Main UK GDPR changes; e-privacy fines raised to GDPR level. | 72 hours (unchanged) | £17.5m or 4% of global turnover |
These are counts of malicious incidents over all three years. Government and tech head the list partly because the Year 3 trackers record many public-sector intrusions. Healthcare incidents are fewer but the most disruptive to people.
Four money flows, indexed to 2024 = 100 so they can share one scale. Losses and defensive spending are rising together. The money paid to criminals as ransoms is falling, and insurance premiums are growing slowly as rates soften.
Expect more single-campaign waves that hit hundreds of tenants through one stolen token or one support platform, as the Snowflake, Salesloft and Klue incidents did.
Russia- and Iran-linked actors have shown they will cause physical effects at dams, power grids, water plants and fuel tanks. Year 4 is likely to test Western responses.
Large outcomes are pending for Change Healthcare, Optus and Medibank. On a 31-month median lag, fines over the 2025 retail attacks would land in 2027–28. Disclosure rules are tightening too: since 30 May 2025, Australian businesses with turnover of AUD 3m or more must report a ransom payment within 72 hours (Verizon 2026 Data Breach Investigations Report).
Chatbot abuse, AI developer supply chains and AI-written phishing are moving from novelty to routine entries in the log. In data from Anthropic, the median threat actor sought AI help with 15 distinct attack techniques, and fewer than 2.5% of AI-assisted malware observations involved rare techniques (Verizon 2026 Data Breach Investigations Report). CrowdStrike counted an 89% rise in attacks by AI-enabled adversaries in 2025 (CrowdStrike 2026 Global Threat Report). The UK NCSC reaches the same view as both: AI is making known attacks faster, not inventing new ones.
The five most recent incidents in the log are below. The explorer has all 93, searchable by organisation, actor or impact, and filterable by year, attack route and sector.
| Date | Organisation | Country | Sector | Attack route | Actor | Records | Cost $m | Status |
|---|
The Cyber Risk Barometer twice a year, plus a monthly round-up of what national CERTs around the world are warning about.