Flagship security reports published in 2025 and 2026 paint a consistent picture: breaches cost more, attackers move faster with AI and identity abuse, and stolen data still surfaces on the dark web long before many organizations finish containment. For buyers evaluating dark web monitoring and cyber threat intelligence, those facts matter more than vendor slogans.
This roundup summarizes the most citable findings from prestige sources—and the cross-industry campaign that turned help-desk social engineering and leak-site extortion into a multi-sector story.
Three reports every security buyer should know
IBM Cost of a Data Breach Report 2026
The global average cost of a data breach rose to $4.99 million—a record high and a 12% increase after the prior year’s dip (IBM). Mean time to identify reached 183 days, with 64 days to contain—a 247-day lifecycle. One in four malicious breaches were AI-enabled, averaging about $6 million. Healthcare remained the costliest industry at $6.64 million; financial services averaged $6.29 million.
IBM also notes a point that is easy to miss in executive summaries: breaches involving removable media or supply-chain compromise lasted 258 days on average—and may only become visible when stolen data appears on the dark web.
Verizon 2026 Data Breach Investigations Report
Verizon’s nineteenth DBIR analyzed more than 31,000 security incidents and 22,000 confirmed breaches across 145 countries (Verizon). For the first time in 19 years, vulnerability exploitation overtook stolen credentials as the leading breach entry point—while AI-accelerated weaponization of known flaws raised the patching pressure on defenders.
Sophos State of Ransomware 2026
Sophos surveyed 2,158 IT and security leaders whose organizations were hit by ransomware (Sophos). Key findings:
- 79% of ransomware attacks started with compromised identities
- Malicious email (26%) and phishing (24%) became the top root causes—overtaking exploited vulnerabilities
- Data encryption rose to 56% of incidents
- Average recovery cost reached $1.70 million (excluding ransom)
- Retail had the lowest ransom payment rate (32%); local/state government had the highest (72%)
Identity compromise and dark web credential markets are two sides of the same coin. When employee or VPN credentials are traded underground, ransomware affiliates gain the foothold Sophos describes.
One campaign, many industries
Between spring 2025 and early 2026, identity-focused threat actors associated with Scattered Spider (and DragonForce ransomware activity) ran a highly visible campaign that jumped sectors—and repeatedly used dark web leak sites and public extortion to apply pressure.
Retail: Marks & Spencer, Co-op, Harrods
In April–May 2025, attackers socially engineered IT help desks and disrupted UK retail giants. Marks & Spencer faced weeks of halted online fulfillment and an estimated £300 million operating-profit hit (BleepingComputer). Co-op confirmed that data belonging to 6.5 million members was stolen and later disclosed roughly £80 million in impact (BleepingComputer; BBC). The UK Cyber Monitoring Centre rated the M&S/Co-op wave a Category 2 systemic event with combined costs estimated at £270–440 million (Computer Weekly).
The same weeks saw consumer-data and e-commerce disruptions at Adidas and Victoria’s Secret (Reuters; Reuters).
Aviation: WestJet, Hawaiian Airlines, Qantas
In June 2025, the same identity-focused tactics expanded into airlines. WestJet later disclosed that 1.2 million people had information stolen, including travel documents (The Record). Qantas reported a third-party contact-centre platform compromise affecting roughly 5.7–6 million customers (CSO Online; Forbes). The FBI warned that Scattered Spider was expanding into the airline ecosystem—including trusted vendors.
Hospitality: Wynn Resorts and leak-site extortion
In February 2026, ShinyHunters listed Wynn Resorts on a dark web leak site, claiming roughly 800,000 employee records (including Social Security numbers) and demanding about $1.5 million in bitcoin. Wynn confirmed unauthorized acquisition of employee data (SecurityWeek; The Register). Leak-site listings of this kind are exactly what continuous dark web monitoring is built to catch early.
Manufacturing: Jaguar Land Rover
In late August 2025, Jaguar Land Rover halted UK vehicle production for weeks after a cyberattack. The UK Cyber Monitoring Centre estimated roughly £1.9 billion in economy-wide impact across more than 5,000 businesses—among the most economically damaging cyber events in UK history (Computer Weekly; SC Media).
What this means for dark web monitoring
Across these incidents, a pattern repeats:
- Identity is the door. Compromised credentials, help-desk social engineering, and third-party access appear again and again—matching Sophos’s 79% identity finding.
- Extortion goes public on the dark web. Ransomware groups and data thieves use leak sites and underground forums to prove possession and raise pressure.
- Detection is still too slow. A 183-day average time to identify a breach means stolen data can circulate for months before internal teams finish scoping.
- Sector hopping is intentional. Retail one month, airlines the next—defenders who only watch their own industry miss the TTP shift.
ACID Technologies monitors the dark web, deep web, paste sites, dump sites, leak sites, and messaging platforms 24/7/365 with client-specific keywords and languages. Real-time alerts—with screenshots and follow-up intelligence—help security teams rotate credentials, contain vendor exposure, and prepare communications before a leak-site post becomes a headline.
Next steps
- Explore industry-specific threat pages for sector stats and incidents
- Read What Is Darkweb Monitoring?
- Review ACID Intelligence and Dark Web Monitoring Service
- Contact ACID to discuss coverage for your organization