A new study from London’s Lab 1 suggests the typical data breach now drags hundreds of uninvolved organisations into the blast zone. For cyber insurers, and for anyone buying cover, it questions whether risk is being priced around the wrong number.
What happened
Lab 1, a London-based firm that sells an exposed-data intelligence platform, has released the second edition of its report The Anatomy of a Breach, covered on 22 October 2026. The headline finding, as reported by Insurance Business UK and Compare the Cloud, is that the median breach in 2026 exposed information belonging to 542 organisations other than the company that was actually compromised.
The study is considerably larger than its predecessor. Lab 1’s own report page describes the 2025 edition as covering 141 million files across 1,297 breaches. According to both press reports, this year’s version analyses 328 million unstructured files drawn from 2,089 breach incidents, and identifies 13,436 distinct organisations whose data surfaced somewhere in that material across 2025 and 2026.
Insurance Business UK, which framed the findings around underwriting, reported that when an insurer is the named victim the median number of other organisations exposed rises to 727. That reflects how much client, counterparty and supplier information insurance firms hold as a matter of routine.
The detail
The figures, as reported by the two outlets, describe both a growing volume problem and a sharper content problem:
- Bigger incidents: Compare the Cloud reports the median breach size reached 29.8GB, up 121.7% on the previous study, with median file counts up 44.5% to 32,734.
- Financial data everywhere: roughly 145 million files, about 44% of the total, held banking details, tax identifiers or invoices, and such material appeared in 95% of incidents.
- HR records: about 9% of files contained payroll, contracts or identity documents, present in 84% of incidents.
- Keys to the kingdom: cryptographic private keys turned up in around 15% of incidents.
- Supplier reach: technology, information and internet companies showed the widest spread, with a median of 6,985 exposed organisations per breach since 2022.
The more worrying shift concerns what criminals do after the theft. Lab 1 says the number of threat groups running structured analysis of stolen datasets stood at a single group in 2024 but had reached seven by the middle of 2026. It describes a group called FulcrumSec claiming to have used AI agents across 700,717 files to locate patient records and other sensitive material, and claiming to have pulled 61 emails with regulatory implications out of an archive of around 400,000 to use as leverage. Insurance Business UK connects FulcrumSec with attacks that include one aimed at Manchester Airports Group. As Compare the Cloud points out, much of this rests on the criminals’ own claims, relayed by Lab 1, so it should be read as indicative rather than proven.
The report also covers Leak Bazaar, an indexing service that it says appeared in March 2026 and repackages stolen corporate data into 16 product categories aimed at specific buyers. According to Insurance Business UK, insurance documents are one of those named categories, with coverage-gap exploitation and policy fraud the stated use.
Why it matters for UK organisations
Most cyber policies, and most board conversations about cyber, still begin with a simple question: will we be breached? Lab 1’s numbers suggest an equally important question is whose breach you will be caught in. If a single compromise at a payroll provider, compliance platform or managed service supplier exposes hundreds of its customers’ records, then a UK business with excellent internal controls can still find its contracts, bank details and staff identity documents circulating on a leak site.
That has direct consequences for insurers. Insurance Business UK, citing Allianz Commercial, reported that stolen data made up 40% of large claim value in the opening six months of 2025, compared with 25% for 2024 as a whole. Combine that trend with breaches that implicate hundreds of third parties and the aggregation risk becomes harder to model from a proposal form that only asks about the applicant’s own estate. Expect more searching renewal questions about suppliers and data flows, and possibly tighter wording on third-party and contingent business interruption cover.
There is a regulatory edge too. Under UK GDPR, an organisation whose data is exposed through a supplier is still the controller for its own customers and staff. Discovering that exposure late, or from a journalist, makes notification decisions far harder.
Expert view
In my experience, the most useful finding in a breached dataset is rarely the customer database. When we test organisations, the material that moves an engagement forward is the dull stuff: an old network diagram, a configuration export, a spreadsheet of service accounts, a private key someone emailed to a contractor. Lab 1’s figure of keys in roughly 15% of incidents will not surprise anyone who does this work.
What has changed is the effort required. Not long ago, making a large dump actionable took a patient analyst weeks, so most were sold on or ignored. If criminal groups are now using AI models to triage files and pick out the regulatory or commercial pressure points, the window between theft and targeted follow-on attacks shrinks considerably. Lab 1 calls this the shrinking “weaponisation tax”, and I think the framing is right even if some of the criminal claims are inflated.
I would be cautious about one thing. This is a vendor report from a company that sells breach intelligence, and the methodology behind the median figures is not fully set out in the coverage I have seen. The direction of travel is credible; the precise numbers deserve scrutiny before anyone builds a pricing model on them.
What to do now
- Map who holds your data. List every supplier that stores staff, customer or financial records on your behalf, and rank them by sensitivity. Payroll, HR, legal, finance and managed IT providers come first.
- Assume your secrets have leaked somewhere. Rotate private keys, API tokens and service account credentials that have ever been shared outside your organisation. This maps directly to the Cyber Essentials user access control and secure configuration requirements.
- Contract for notification. Make sure supplier agreements require prompt notice of any compromise involving your data, with enough detail for you to make your own UK GDPR assessment.
- Monitor for exposure. Use breach monitoring, whether a commercial service or a well-run threat intelligence process, to spot your domains, documents and staff names in leak material early.
- Review your policy wording. Ask your broker how your cover responds when your data is stolen from a supplier rather than from you, and whether contingent business interruption and third-party liability limits are realistic.
- Clean up what you hold. Delete old exports, archives and shared folders you no longer need. Data that is not there cannot be stolen, from you or anyone else.
Bottom line
Lab 1’s report reframes breach risk as a supply chain issue rather than a single-company event. Even allowing for vendor framing and unverified criminal claims, the message for UK organisations and their insurers is clear: your exposure is defined by the weakest supplier holding your data, and attackers are getting faster at finding it.
