302.ai Data Leak: 17.6 Million Files in an Open Azure Bucket
Cybernews says AI aggregator 302.ai left 17.6 million files, including chat logs, in a public Azure bucket. What is confirmed and what to check.
Data breaches and regulatory penalties by region, with every figure linked to its official source.
Losses (bars) Complaints (line)
Ransomware and data-breach complaints from critical-infrastructure sectors, 2024 (number of complaints, not money)
Ransomware Data breach
Complaints to the FBI IC3 from organisations in 14 US critical-infrastructure sectors (2024 report, p.12). The 2025 report names the most-hit sectors but gives no counts. Source: FBI IC3 Internet Crime Report 2024.
Ransom received per group (USD millions)
Ransom payments received, as stated by officials. Figures cover different periods and aren't comparable totals.
Each bar is one official statement; bar length uses its leading number only. Quotes and sources are on the Threat groups page.
What victims told the FBI they lost to cybercrime each year, from the annual reports of its Internet Crime Complaint Center (IC3). It counts every kind of cybercrime, not only data breaches: investment and romance fraud, business email compromise, ransomware and more. Most complaints come from the US. Read it as a floor: many victims never report, and no organisation publishes a worldwide total for breaches alone. 2012 and 2014 are missing because those reports give the total only inside a chart.
Sources
Average cost per data breach by industry (USD millions)
2026 2025
IBM/Ponemon, Cost of a Data Breach Report 2026, Figure 4. Earlier reports show industry costs only as chart images, so only 2026 and 2025 are listed. Source: IBM Cost of a Data Breach Report 2026.
Victims per group (number of organisations, not money)
Victims stated by officials (as-of dates differ)
Each bar is one official statement; bar length uses its leading number only. Quotes and sources are on the Threat groups page.
The average cost of one breach across the organisations IBM/Ponemon studied that year. A single global average was first published with the 2014 study; earlier studies were country by country.
Sources
| Year | North America | Latin America | Europe | Middle East & North Africa | Asia | Australia & New Zealand | Sub-Saharan Africa |
|---|---|---|---|---|---|---|---|
| 2026 | USD 8.35M ▲ above global average | USD 3.03M ▼ below global average | USD 4.93M ▼ below global average | USD 8.00M ▲ above global average | USD 3.64M ▼ below global average | USD 2.96M ▼ below global average | USD 3.04M ▼ below global average |
| 2025 | USD 7.53M ▲ above global average | USD 2.52M ▼ below global average | USD 4.32M ▼ below global average | USD 7.29M ▲ above global average | USD 3.28M ▼ below global average | USD 2.55M ▼ below global average | USD 2.37M ▼ below global average |
| 2024 | USD 7.01M ▲ above global average | USD 2.76M ▼ below global average | USD 4.93M ▲ above global average | USD 8.75M ▲ above global average | USD 3.26M ▼ below global average | USD 2.78M ▼ below global average | USD 2.78M ▼ below global average |
| 2023 | USD 7.30M ▲ above global average | USD 2.46M ▼ below global average | USD 4.21M ▼ below global average | USD 8.07M ▲ above global average | USD 3.25M ▼ below global average | USD 2.70M ▼ below global average | USD 2.79M ▼ below global average |
| 2022 | USD 7.54M ▲ above global average | USD 2.09M ▼ below global average | USD 4.01M ▼ below global average | USD 7.46M ▲ above global average | USD 3.25M ▼ below global average | USD 2.92M ▼ below global average | USD 3.36M ▼ below global average |
| 2021 | USD 7.23M ▲ above global average | USD 1.82M ▼ below global average | USD 4.08M ▼ below global average | USD 6.93M ▲ above global average | USD 3.20M ▼ below global average | USD 2.82M ▼ below global average | USD 3.21M ▼ below global average |
| 2020 | USD 6.57M ▲ above global average | USD 1.40M ▼ below global average | USD 4.17M ▲ above global average | USD 6.52M ▲ above global average | USD 2.97M ▼ below global average | USD 2.15M ▼ below global average | USD 2.14M ▼ below global average |
| 2019 | USD 6.31M ▲ above global average | USD 1.35M ▼ below global average | USD 4.33M ▲ above global average | USD 5.97M ▲ above global average | USD 2.73M ▼ below global average | USD 2.13M ▼ below global average | USD 3.06M ▼ below global average |
| 2018 | USD 6.33M ▲ above global average | USD 1.24M ▼ below global average | USD 4.17M ▲ above global average | USD 5.31M ▲ above global average | USD 2.56M ▼ below global average | USD 1.99M ▼ below global average | USD 2.90M ▼ below global average |
| 2017 | USD 5.83M ▲ above global average | USD 1.52M ▼ below global average | Not in report | USD 4.94M ▲ above global average | Not in report | Not in report | Not in report |
| 2016 | USD 7.01M ▲ above global average | Not in report | Not in report | Not in report | Not in report | Not in report | Not in report |
| 2015 | USD 5.46M ▲ above global average | USD 1.77M ▼ below global average | USD 4.30M ▲ above global average | USD 3.80M ▲ above global average | USD 2.07M ▼ below global average | USD 2.61M ▼ below global average | Not in report |
| 2014 | USD 5.85M ▲ above global average | USD 1.61M ▼ below global average | USD 4.21M ▲ above global average | USD 3.12M ▼ below global average | USD 1.86M ▼ below global average | USD 2.59M ▼ below global average | Not in report |
| 2013 | USD 5.40M | USD 1.32M | USD 3.98M | Not in report | USD 1.70M | USD 4.10M | Not in report |
| 2012 | USD 5.50M | Not in report | Not in report | Not in report | Not in report | Not in report | Not in report |
| 2011 | USD 7.24M | Not in report | Not in report | Not in report | Not in report | Not in report | Not in report |
| 2010 | USD 6.75M | Not in report | Not in report | Not in report | Not in report | Not in report | Not in report |
| 2009 | USD 6.66M | Not in report | Not in report | Not in report | Not in report | Not in report | Not in report |
| 2008 | USD 6.36M | Not in report | Not in report | Not in report | Not in report | Not in report | Not in report |
| 2007 | USD 4.79M | Not in report | Not in report | Not in report | Not in report | Not in report | Not in report |
| 2006 | USD 3.54M | Not in report | Not in report | Not in report | Not in report | Not in report | Not in report |
Average total cost of a data breach as published in IBM/Ponemon "Cost of a Data Breach" reports, by report year, in US dollars. Early studies published only in local currency are left out, not converted. Each region is the average of the markets that year’s study reports for it (North America: United States, Canada; Latin America: Latin America, Brazil; Europe: United Kingdom, Germany, Benelux, France, Italy, Scandinavia; Middle East & North Africa: Middle East; Asia: Japan, India, ASEAN; Australia & New Zealand: Australia; Sub-Saharan Africa: South Africa); hover a figure to see which. Years with no published figure are left out (the series starts in 2006); "Not in report" means that year’s study did not cover the region, not that it had no breaches. Averages are not added up across years: selecting several years on the map shows their average. Map colours run from yellow (lower cost) to dark red (higher cost), relative to the regions shown. ▲ / ▼: above or below that year’s global average cost per breach.
Cybernews says AI aggregator 302.ai left 17.6 million files, including chat logs, in a public Azure bucket. What is confirmed and what to check.
In July 2026 OpenAI's test agents reached Hugging Face's systems. What each company reported, what was affected, and the sandbox controls to check.
In 2026 CodeWall's AI agent tested McKinsey's Lilli chatbot under its disclosure policy. What it reported, what McKinsey said, and what to check.
A researcher says a Firebase error left about 300 million Chat & Ask AI messages readable. What is confirmed, what is not, and what to check.
What was stolen in SK Telecom's 2025 USIM breach, how many subscribers were affected, what Korea's regulators found, and the PIPC's 134.8 billion won fine.
In January 2025 Wiz found an open DeepSeek database with over 1 million log entries. What was exposed, what regulators did, and what IT teams should check.
What Hugging Face said about unauthorised access to Spaces secrets in May 2024, what is unknown, and how AI teams should handle tokens and CI/CD secrets.
The 2024 Change Healthcare ransomware attack: what happened, people affected, UnitedHealth's disclosed costs, and what is known of HHS OCR's response.
What OpenAI says happened in the March 2023 ChatGPT bug and the 2025 Mixpanel incident, what data was exposed, and what to ask your AI vendors.
How a hijacked Microsoft 365 mailbox led ADGM's data regulator to reprimand VentureRock in 2023, why there was no fine, and what to check in your estate.
How the 2022 Medibank data breach happened, who was affected, what the OAIC alleges in its Federal Court case, and what security teams should check.
What Optus said about its 2022 cyberattack, what the OAIC and ACMA allege in Federal Court, the penalty limits, and what security teams should check.
In 2022, valid credentials ran 90M+ queries on Brazil's INSS benefits system. What ANPD found, the sanction, and what to check in your own estate.
How Conti's April 2022 ransomware attack hit Costa Rica's customs and tax systems, why a national emergency followed, and what to check.
Ransomware hit South Africa's Justice Department in 2021. The regulator found lapsed security licences and later issued a R5 million POPIA fine.
Meta's 2023 €1.2bn GDPR fine: what Ireland's DPC decided, why the EDPB stepped in, and what it means for EU-US data transfers.
The 2018 SingHealth data breach hit about 1.5 million patients. How attackers got in, the S$1 million PDPC penalties, and lessons for IT teams.
How attackers skimmed British Airways card data in 2018, why the ICO fined £20m not £183.39m, and the controls the ICO says were missing.
The 2017 Equifax breach exposed data on about 147 million people. How attackers got in, what the 2019 settlement cost, and what to check in your estate.
What the Shamoon wiper did to Saudi Aramco in 2012, how destructive malware works, what Aramco says it learned, and the controls to check.
What Anthropic and Google's threat reports say about AI model misuse: four cases, what the companies did, and what defenders should log and ask.