Data theft overtakes encryption in cyber intrusions

LevelBlue has published research showing that data theft overtook encryption as the main form of leverage in cyber intrusions during the third quarter. Exfiltration featured in 83 per cent of the cases it investigated.

The findings suggest a shift in attacker tactics, with greater reliance on stolen information and threats to publish it rather than on ransomware alone. Encryption still appeared in 67 per cent of intrusion cases, down from parity with exfiltration in the previous quarter.

Extortion-only attacks, in which no ransomware is deployed, rose to 33 per cent of cases from 23 per cent in the second quarter, making them the fastest-growing attack type in the period covered by the briefing. Attacks combining encryption and exfiltration remained the most common at 50 per cent, although that share has fallen each quarter this year from 60 per cent at the start of the year.

Files were exfiltrated in 40 per cent of cases in which data was put at risk, up from 31 per cent in the prior quarter. The most active ransomware and extortion groups observed during the period were Akira, ShinyHunters, Qilin, INC and Helix.

Identity abuse

The report also found that identity remained central to many intrusions. Attackers using legitimate credentials can blend into routine activity and reduce their reliance on malware, making them harder for defenders to detect.

Business email compromise was the most common incident type, accounting for 32 per cent of engagements, although that was down from 45 per cent in the previous quarter as other forms of attack increased. In cases in which multi-factor authentication had been deployed, it was bypassed in 79 per cent of business email compromise incidents.

Credential stealers were used in 67 per cent of cases in which privilege escalation was observed, up from 50 per cent in the second quarter. Abuse of valid accounts as an initial access method increased for the third consecutive quarter.

One tactic identified in the briefing involved voice phishing, or vishing, used to persuade victims to enrol an attacker-controlled device on an account. Because the victim approves the registration, the resulting access can appear legitimate.

Access routes

Phishing and social engineering remained the leading initial intrusion vector, accounting for 42 per cent of cases, although that was lower than the 65 per cent recorded in the second quarter. At the same time, attacks exploiting internet-facing routes regained prominence.

External remote services such as virtual private networks and remote desktop accounted for 14 per cent of initial access, up from 9 per cent. Exploited vulnerabilities also represented 14 per cent, meaning internet-facing systems together accounted for more than a quarter of initial access routes.

LevelBlue highlighted a critical flaw in Metabase, an open-source business intelligence platform, as an example of that risk. In its investigations, attackers used the vulnerability, identified as CVE-2026-72898, to create administrator accounts and API keys, access connected databases, steal data and, in some cases, extort victims.

The briefing also said threat actors are using artificial intelligence tools to search for exposed application programming interface keys. Such keys can be long-lived and over-permissioned, and may allow access that bypasses multi-factor authentication controls.

Faster intrusions

The pace of attacks also increased during the quarter. More than half of incident response engagements, or 56 per cent, began within 10 days of the initial compromise, up from 49 per cent in the previous quarter.

Cases beginning within two days of compromise more than doubled to 18 per cent from 7 per cent. Meanwhile, engagements starting more than 31 days after compromise edged down to 21 per cent from 23 per cent.

By sector, technology and software became the most targeted industry for the first time, representing 14 per cent of incidents, up from 5 per cent in the previous quarter. Healthcare and manufacturing followed, while financial services fell from first place to fourth.

Organisations with revenue between USD $1 million and USD $100 million accounted for the largest share of incidents in the reporting period. The data was drawn from frontline incident response investigations conducted between July and September, with additional intelligence from SpiderLabs.