AI Indexing Expands the Reach of Data Breaches Across Supply Chains

AI is changing the economics of a data breach: criminals can now scan stolen files at scale, find sensitive details and use them to target organizations connected to the original victim. Lab 1 estimates that in 2026 a breach exposed a median of 542 additional organizations, up from 482 the year before.

That widening reach matters for security leaders because a company’s contracts, emails and supplier records can expose other businesses even when their own systems weren’t breached. The data can remain useful well after the initial incident, especially as automated analysis makes it easier to connect people, credentials and business relationships.

More data, more organizations in the blast radius

Lab 1’s 2026 Anatomy of a Breach Report examines 328 million files across 2,089 datasets published after breaches, including ransomware extortion incidents. The report draws on “ransomware and data-breach incidents in the public domain, reconstructed from forensic acquisitions of compromised systems,” the company said.

The median breach grew to 29.8GB and 32,734 files. That’s a 122% increase in data volume from 13.44GB in 2025, while the file count rose 45% from 22,647. Lab 1 says the larger troves give criminals more material for fraud, extortion and follow-on attacks. Across incidents from 2025 to 2026, the company identified 13,436 organizations exposed through breaches.

Ricardo Amper, founder and CEO of identity verification company Incode Technologies, says the figures match what he sees, and may be conservative. Previously, stolen files could sit on a forum while criminals spent time searching them. “AI removed that bottleneck,” he says.

“So every file now gets read, cross-referenced, and turned into a target list,” Amper says. The resulting fraud can reach suppliers, customers and partners whose details appear in the files.

What attackers can extract from exposed files

Lab 1 used AI agents to inspect files including unstructured documents such as emails and PDFs. Of the 328 million files analyzed, about 145 million, or 44%, contained financial information such as bank details, tax identifiers and invoices.

Another 29 million files, or 9%, held HR material, including payroll records, employment contracts and identity documents. Such information can make business email compromise and other social engineering attempts more convincing. Private cryptographic keys appeared in roughly 15% of incidents, according to the report.

The risk extends beyond the direct contents of a file. A contract may map a supplier relationship; an email thread may expose credentials or identify a person who can be impersonated. Linking those details gives attackers a route to pursue targets beyond the breached company.

Criminal services turn breach data into intelligence

Lab 1 Threat Intelligence identified seven threat actor groups conducting structured analysis of stolen data. The most advanced are using AI to index breached files and offering that capability to other criminals as a service. The first such indexing service appeared in March 2026, according to Lab 1.

The service reportedly sorts documents into monetizable categories, maps relationships, flags damaging files and helps estimate ransom demands. Lab 1 says the intelligence offered through these services has included “share-buyback information for market manipulation, correspondence with sanctioned entities for use in ransomware negotiations, and security reports that could support follow-on attacks.”

FulcrumSec, a threat actor group, claimed it took an archive of 400,000 emails and singled out 61 messages about engagements with US-sanctioned entities, which it could use to apply regulatory and reputational pressure. The group also claimed AI agents searched 700,717 breached files and found 11,500 patient records tied to named clinical trials.

Third-party exposure requires a broader response

Lab 1 co-founder and CEO Robin Brattel says the time and expertise once needed to find sensitive material limited how criminals could exploit stolen datasets. “AI and criminal indexing services are removing those barriers,” he says. A breach can therefore affect organizations named in the data as well as the victim itself.

Zero Networks CEO Benny Lakunishok points to the next step: attackers using information to gain access and move between systems or organizations. He says AI can reduce analysis that once took weeks to minutes, uncovering credentials, business ties and new targets.

For CISOs, that calls for a clearer view of what suppliers hold. Credentials and keys can be revoked or rotated; invoices, contracts, supplier links and internal communications can’t be changed after exposure. Brattel says those records may remain useful to attackers for years.

Security teams should know which suppliers store sensitive information about their organization and ensure they’re notified quickly when a supplier is compromised. That visibility won’t prevent every breach, but it can help teams understand when a third-party incident has become their own exposure.