In the first nine months of 2026, the number of data breach incidents in Russia fell by 42% to 333 cases, compared to 573 in the same period of 2025. The total volume of leaked data decreased by 19%, dropping from 2.61 billion to 2.11 billion records. Five major incidents accounted for 83% of the total volume, with the largest single breach responsible for 50%.
The industry distribution of leaks shifted significantly. Transport and delivery sectors saw their share of leaked data grow from 5.7% to 53%, totaling 1.12 billion records. The tourism industry's share rose from 0% to 25% (523.6 million records). Together, these sectors accounted for nearly 80% of all leaked data, while the government sector's share fell from 84% to less than 1%.
The number of unique phishing resources increased by 25% year-on-year. Analysts attribute this growth to the use of AI for domain registration and content generation. Despite this, the median blocking time for malicious resources dropped by 70%, from 11.5 hours in 2025 to 3.5 hours in 2026.
Phishing domain distribution changed, with the .com zone share rising from 7% to 51.5%, while the .ru zone share fell from 19.5% to 13%. The use of domains with serial pseudo-random prefixes, indicating automated creation, increased from 25% to 45%. Experts link these trends to AI-driven automation and the availability of inexpensive domain zones for scaling malicious infrastructure.