Tanaka emerges as top data leak broker in first half of 2026

Following insights from The Cyber Express, the cybercrime economy is increasingly valuing stolen data as a significant commodity, with one threat actor, Tanaka, leading the data leak landscape in the first half of 2026. Cyble researchers documented 367 data breach and leak incidents globally during this period, highlighting Tanaka's prolific activity as a data leak broker.

Tanaka accounted for 25 distinct leak posts, more than double the activity of other major actors, demonstrating a broad targeting approach across multiple industries and regions. While the Banking, Financial Services, and Insurance (BFSI) sector remained the most targeted with 38 incidents, government and technology organizations also faced significant exposure. Tanaka's operations were visible across North America, Europe, and the UK, indicating a global footprint independent of geography. This trend reflects a broader shift where data leaks have become a standalone business model, monetized through underground marketplaces for fraud, extortion, or resale, rather than solely being a byproduct of ransomware attacks. Organizations must treat underground data exposure monitoring as a critical part of their defense strategy to identify early warning signs of compromise.

Source: The Cyber Express