Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-10 · high
Zscaler's ThreatLabz found two-thirds of 351 ransomware victims held manager titles, three-quarters worked outside IT.
Why now: The Register's write-up of Zscaler's findings lands as ransomware crews keep moving off executives toward staff with business access.
Zscaler ThreatLabz combed through 351 ransomware victims across 334 organizations and found most weren't executives or IT staff, per The Register.
Nearly two-thirds held manager titles or higher, and three-quarters worked outside IT, in roles like accounting, finance, sales, operations, HR, or marketing. The average victim was 46, a different profile than the CEO or systems administrator most phishing training assumes is the target.
The shift shows up in the numbers too. Blocked attack attempts rose 146% year over year, public extortion cases climbed 70%, and data theft volume jumped 92%.
The framing from the analysis is that attackers optimize for business privilege over technical access. A mid-career manager in accounting or operations sits closer to the money and the paperwork than someone in the security team. That's the calculation driving the shift.
Watch whether upcoming breach reports keep showing this same middle-management pattern. If they do, awareness training built around org-chart seniority needs a rewrite.
Each link below shares sources, entities, or timing with this story.
Shared entity: CEO / Same source domain / Shared topic / Earlier coverage / Tension
Both cover CEO; reported by the same outlet (theregister.com); overlapping topics (business, data).
Shared entity: YoY / Shared topic / Earlier coverage
Both cover YoY; overlapping topics (access, attacker, average); earlier YoY coverage from 2026-02-25.
Same source domain / Shared topic / Tension
Reported by the same outlet (theregister.com); overlapping topics (access, data); pushes against this story (versus).
Shared entity: YoY / Earlier coverage / Tension
Both cover YoY; earlier YoY coverage from 2026-08-09; pushes against this story (but).
Both cover YoY; earlier YoY coverage from 2026-08-02; pushes against this story (against).
Both cover YoY; earlier YoY coverage from 2026-07-25; pushes against this story (against).
Shared entity: CEO / Earlier coverage / Tension
Both cover CEO; earlier CEO coverage from 2026-07-22; pushes against this story (against).
Both cover CEO; earlier CEO coverage from 2026-07-15; pushes against this story (but).