Data stolen in ransomware attacks surged 275% to 896.2 terabytes in the past year, with attackers carrying out more than 1,500 attacks, according to Zscaler’s 2026 Ransomware Report released on Tuesday.

The cybersecurity firm said at least $328 million in ransom payments could be traced to blockchain wallets, with the average ransom demand reaching $431,995. Freight and logistics firms saw attacks jump 725%, while 62% of victims were at manager level or above.

Three groups — Qilin, Akira and INC Ransom — accounted for about 34% of listings on ransomware leak sites. The United States faced 50.7% of all recorded activity, the report said.

Attackers increasingly abuse legitimate tools such as Microsoft Teams and Quick Assist, posing as IT helpdesk staff to trick employees. Zscaler urged companies to adopt zero-trust security models and train staff to verify unexpected tech-support calls through official channels. The report also noted that attackers are getting faster, with the time between initial intrusion and data theft shrinking steadily. Zscaler said organisations that segmented their networks and kept offline backups recovered far more quickly, often without paying the ransom at all.