On 29 July 2026 Veeam published Coveware's Q2 2026 extortion data. Software Services was the most represented sector at 17.2% of cases, ahead of Healthcare at 14.1% and Professional Services at 13.1%. If you run a SaaS company, you are in the group these numbers describe.
What's affected
Three findings matter most for a software company.
- Data theft is the norm. Exfiltration was observed in 76% of cases. Backups help you recover, but they do not un-steal data.
- Payment on theft alone is falling. The payment rate for exfiltration-only cases dropped to a historically low 15%, and the report notes a new record low overall payment rate.
- Entry is through people and identities. Phishing and social engineering moved back into the lead, and compromised credentials kept rising. Remote access compromise declined from its late-2025 peak.
The average payment rose 176% from Q1 to $1,880,612, while the median fell 50% to $150,000. The average and the median moved in opposite directions, so do not size your plan on the average alone. The sector, vector and exfiltration figures say more about what to prepare for.
What to do now
- Treat identity as the main control. Phishing-resistant MFA (passkeys or security keys) for staff, mandatory for admins, and a verified process for resetting it.
- Protect the places your data lives. Inventory every SaaS tool with customer data, check its audit log retention and revoke unused integrations and tokens.
- Assume copy, not just encrypt. Decide in advance who tells customers, regulators and your insurer, and when.
- Keep backups out of reach of production credentials, and restore from them on a schedule.
- Agree your payment position before an incident. Write who decides, what advice you will seek and what you will never do. Many incidents also carry sanctions and reporting questions, so involve counsel early.
- Run the vishing and outage tabletops, and fix the gaps.
Why it matters
When theft is the main event, the question after an incident is "what did they take and who must be told", not just "how fast can we restore". That answer depends on logs, data maps and tenant boundaries you built before the day.
A small SaaS company cannot out-spend an extortion crew. It can make sure it knows where customer data lives and can prove what happened.
Quick check
Why do backups not solve most extortion cases in this dataset?
Because exfiltration was observed in 76% of cases. Restoring systems does not retrieve stolen data, so notification, legal and customer duties remain.
