Global study reveals that AI is amplifying phishing, impersonation and credential theft, transforming ransomware into a human-centric extortion problem
-
40% of organizations said employees trusted AI-powered attacks, while 38% interacted with malicious content.
-
More than one-third (34%) of attacks began with phishing emails or other email-based social engineering.
-
More than two-thirds of victims had data stolen, and 37% of those who paid faced additional ransom demands.
SUNNYVALE, Calif., July 22, 2026 – Proofpoint, Inc., a global leader in human- and agent-centric security, today released its 2026 AI-Era Ransomware Report, revealing that artificial intelligence is making ransomware significantly more successful by helping attackers create more convincing phishing, impersonation and credential theft campaigns. The global study found that nearly two-thirds (65%) of global organizations affected by ransomware said AI increased the effectiveness of the attack, reinforcing a broader shift in which ransomware increasingly succeeds by exploiting people, identities and trusted communications.
Based on a survey of 953 cybersecurity professionals across 12 countries, the research shows that modern ransomware has evolved beyond an encryption event into a sustained extortion campaign. Attackers are increasingly stealing credentials and sensitive data before deploying ransomware, using trusted communications to gain initial access and applying continued pressure through repeated extortion demands.
"AI hasn't fundamentally changed ransomware, but it has materially improved the attacks that lead to ransomware," said Ryan Kalember, Chief Strategy Officer at Proofpoint. "Today's attackers are using AI to create highly convincing phishing emails, malware components like scripts, and credential theft campaigns that exploit human trust at scale. Organizations that continue treating ransomware and data extortion as endpoint or recovery problems are missing what these attacks most frequently begin with: people, identities and trusted communications."
Key global findings from Proofpoint’s 2026 AI-Era Ransomware Report include:
-
People are the primary ransomware attack surface, and AI is making it worse. With AI, attackers can create more convincing phishing lures, write more targeted impersonation messages, and do faster reconnaissance of organizational structures and message patterns. Among the global organizations that experienced a ransomware attack, 28% said that AI significantly increased the attack’s effectiveness. Another 37% said that it somewhat increased effectiveness. Combined, 65% said AI made the attack more effective. Only 9% reported no evidence of AI use at all.
-
The leading entry methods are all human-dependent. When organizations identified the primary point of entry for their ransomware incident, the results pointed overwhelmingly to human interaction. Phishing emails and other email-based social engineering attacks were the initial entry vector in 34% of incidents. Malicious links (47%) were identified as the most common initial threat, followed by malicious attachments (46%), credential harvesting (36%), and Business Email Compromise (35%). This demonstrates that today's most successful ransomware campaigns continue to rely on trusted communications and user interaction throughout the attack lifecycle.
-
Payment leads to escalation, not resolution. Despite years of guidance from law enforcement and security agencies advising against payment, more than half (54%) of affected organizations paid a ransom. Yet, more than one-third (37%) of those that paid faced a second extortion demand, highlighting ransomware's evolution from a single payment event into an ongoing negotiation in which attackers hold multiple forms of leverage at the same time: continued encryption, stolen data, and the threat of public disclosure.
-
Encryption is no longer the endgame. Almost two-thirds of organizations confirmed that data was stolen during the incident. Today’s ransomware campaigns are less about locking systems and more about acquiring data, identities, and persistent access. These can be monetized through repeated demands, sold on criminal marketplaces, or used as launching pads for secondary attacks.
-
Attacks succeed through manipulation. When respondents were asked why the ransomware attack was able to bypass their existing controls, the top two answers had nothing to do with technical failures. Forty percent of organizations said employees did not suspect the attack because it appeared authentic, while 38% attributed the incident to users interacting with malicious content - evidence that AI is making social engineering attempts increasingly difficult to distinguish from legitimate business communications.
-
U.S. organizations reported the highest level of impact. Respondents in the United States reported the highest rates of AI-enhanced attack effectiveness (81%), ransom payments (93%) and confirmed sensitive data theft (60%), suggesting that U.S.-based organizations face attacks that are more sophisticated in their impersonation. Meanwhile, user interaction as a bypass factor was highest in Japan (49%), India (49%), and Singapore (48%). In these markets, the most common failure mode was users engaging directly with malicious content rather than being deceived by impersonation.
The findings reinforce that organizations can no longer treat ransomware primarily as a malware problem. As AI makes phishing, impersonation and credential theft increasingly convincing, preventing ransomware means protecting people, identities and trusted communications before attackers ever reach the endpoint.
Proofpoint’s 2026 AI-Era Ransomware Report is available at: https://www.proofpoint.com/us/resources/threat-reports/ai-era-ransomware-report
Methodology
Between March and April 2026, 953 full-time security professionals across organizations of varying sizes and industries were surveyed. Respondents represented 20 industries and spanned 12 countries, including the U.S., the U.K., France, Germany, Italy, Spain, the UAE, Australia, Japan, Singapore, India, and Brazil.
About Proofpoint, Inc.
Proofpoint, Inc. is a global leader in human- and agent-centric cybersecurity, securing how people, data and AI agents connect across email, cloud and collaboration tools. Proofpoint is a trusted partner to over 80 of the Fortune 100, over 14,000 large enterprises, and millions of smaller organizations in stopping threats, preventing data loss, and building resilience across people and AI workflows. Proofpoint’s collaboration and data security platform helps organizations of all sizes protect and empower their people while embracing AI securely and confidently. Learn more at www.proofpoint.com.
Connect with Proofpoint on LinkedIn.
Proofpoint is a registered trademark or tradename of Proofpoint, Inc. in the U.S. and/or other countries. All other trademarks contained herein are the property of their respective owners.