Of these cases, 91 databases were openly posted on underground Telegram forums and channels, while 73 were offered for sale. F6 clarified that many of the reports are based on advertisements and posts on such sites. The organizations allegedly affected have not independently confirmed each incident.
The perpetrators typically did not explain how they obtained the databases, so the 600 million records refer to the cases F6 identified and not necessarily confirmed breaches by all organizations.
Which areas had the most data?
The Commonwealth of Independent States countries appear with more than 257 million exposed records, despite accounting for just 4% of the recorded leaks. The largest share came from a leak in Tajikistan in September 2025, with around 217 million records. Kazakhstan follows with 25 million and Uzbekistan with 15 million.
Latin America had the highest rate of leaks, with 33% of the total and more than 210 million records exposed. Argentina accounted for about 120 million of these, while Mexico accounted for 38 million.
The Middle East and Africa accounted for 29% of the leaks, with more than 136 million records exposed. Egypt had 54 million, Saudi Arabia 27 million, the United Arab Emirates 25 million, and Qatar 22 million.
The Asia-Pacific region accounted for 8% of the leaks and more than 83 million records exposed. Malaysia had about 35 million, India 34 million, and China 9 million.
F6 said it examines data for Russia and Belarus separately. For this reason, the numbers in this report should not be considered a complete comparison of all countries in the world.
Government bases and artificial intelligence companies
Government databases made up just 23% of the recorded cases. However, they contained 56% of all exposed records in the study. Retail followed with 20%, while real estate, education and finance accounted for 7%, 6% and 5% respectively.
F6 also documented alleged breaches at AI companies. The cases involved an AI platform for online services, a marketing firm, a video analytics company, and several task automation services. The allegations involved the services’ code, user data, and entire conversations with AI systems in different cases.
In one such report, an automation platform allegedly contained data on more than 500.000 users and two million interaction records. The publication also reported codes stored in a non-readable format and the full history of conversations with the service. This particular case is based on an underground forum post and has not been confirmed by the organization allegedly affected.
More attacks that lock files
The report also examines attacks that lock files and force organizations to pay to reopen them. F6 identified 54 new groups in 2025 and another 12 in the first half of 2026. In total, it recorded more than 9.300 incidents throughout the period.
F6 attributed more than 1.000 attacks to the Qilin group in 2025 and nearly 500 more in the first half of 2026. According to the company, the groups are now placing less emphasis on paying to unlock files. Instead, they are pushing harder by publishing stolen data and threatening to damage organizations' reputations.
F6 expects competition between Qilin, DragonForce and LockBit 5.0 to intensify as the teams try to attract more partners and attract them with better terms and more automation.
Lada Kryukova, head of F6’s underground network research unit, said the volume of data circulating online can be much larger than the number of initial incidents. Large collections, repeated postings and large-scale leaks can increase the impact of a breach for a long time after the initial incident.
Your comments will not be published if: