Data exfiltration appeared in 83% of intrusion cases handled by LevelBlue during the third quarter of 2026, up from 77% in Q2, according to the company’s latest incident response briefing. Encryption fell to 67% from 77%, suggesting attackers are relying more heavily on stolen data as leverage.
The report draws on global incident response engagements and LevelBlue SpiderLabs intelligence. It found that exfiltration-only extortion was the fastest-growing attack category, while campaigns combining encryption and theft remained the most common but continued to lose share.
Identity abuse ran through many of the incidents. Attackers bypassed multifactor authentication in 79% of business email compromise cases where MFA was enabled, often by convincing victims to enroll an attacker-controlled device. Business email compromise still led all incident types at 32% of engagements, down from 45% in Q2.
Initial access also became more diverse. Phishing remained the top entry vector at 42%, but external remote services and exploited vulnerabilities each accounted for 14%. LevelBlue said internet-facing flaws and remote access services together represented more than a quarter of observed footholds.
Attackers also moved quickly. Fifty-six percent of engagements began within 10 days of compromise, up from 49% in Q2. LevelBlue said some intrusions now unfold in hours, although the company noted that shorter dwell time can reflect both faster detection and faster attacker execution.
For defenders, the findings argue for controls that track sessions and outbound data rather than relying only on login protection and ransomware encryption alerts. LevelBlue recommends phishing-resistant MFA, shorter token lifetimes, tighter OAuth consent controls, emergency patching for internet-facing systems and monitoring for bulk transfers, archive staging and new cloud destinations.
