The last few months have delivered a blunt message: breaches are no longer rare events. For many organisations the question has moved from "can we prevent every breach?" to "what is our data still worth to an attacker after it leaves?"
Attackers increasingly focus on data theft and extortion, because stolen copies give them leverage for a long time: fraud, identity abuse, repeat extortion and pressure through regulators and litigation. The breach is not a single event. It is the start of a liability cycle that can last years.
Signals from December 2025 to February 2026
- Year-end: security reporting described a rise in ransomware activity over the holiday period, when staffing is thin.
- January: incident volumes stayed high across sectors, suggesting a structural rather than seasonal level.
- February: several incidents centred on identity data were reported, including a telecoms provider in the Netherlands (Odido) with millions of customers affected, a consumer brand (Canada Goose) and a financial-sector event in Abu Dhabi where identity documents were exposed.
Figures and details are as publicly reported at the time.
Where the cost arrives
Industry studies put the average cost of a data breach at several million US dollars, and much of that cost arrives after the first response: investigation, notification, customer support, legal claims, regulatory action and churn. Cyber-insurance underwriting has tightened, and personal-data breach notifications across Europe continue to rise as reporting duties expand.
The gap: security stops where liability begins
Enterprise security stacks are good at prevention and detection. After data has been copied, though, most organisations have little control over what happens to it, and little evidence to show what they did. If attackers hold usable copies, exposure continues after systems are restored.
Where PastWipe fits
PastWipe™ focuses on what happens after data leaves the environment. For selected high-value data it:
- attaches policy covering purpose, identity, device, environment and time
- re-checks those conditions at the point of use, and can deny, restrict or degrade use
- records each decision as evidence for security, legal, compliance and insurance review
PastWipe reduces the usable value of stolen copies outside approved conditions, and so reduces downstream fraud, identity abuse and long-tail cost. It works alongside breach prevention; copies that have already become unrestricted plaintext are outside enforcement.
Questions for the board
- Which datasets would do the most damage if copied, and for how long would they stay valuable?
- What could we show a regulator or insurer about requests for that data after an incident?
- Is post-breach impact part of our risk appetite, or only breach likelihood?
Scope an evaluation · Trust Centre
All insights and news · Get the quarterly Post-Breach Briefing