Data gathered by Check Point Research put the typical organisation's exposure at roughly 2,803 cyber intrusion attempts per week during September. Compared with the prior year, that figure had grown by 48 per cent.
The same monthly dataset pointed to a 16 per cent uptick compared with August, with phishing campaigns, ransomware events, and the leaking of confidential data through corporate adoption of generative AI tools all registering upward movement.
Among all sectors tracked, education drew the heaviest volume of cyber incidents, averaging 6,656 attacks on each organisation every week. Compared with the same period a year prior, that figure ran 59 per cent higher, and against August's reading it sat 24 per cent above.
Among the sectors tracked, telecoms logged an average of 3,483 intrusion attempts per organisation each week, placing it one position ahead of government bodies, which recorded 3,443. Sectors that serve large consumer bases while maintaining layered digital systems recorded measurable increases in operational pressure.
Organisations across Latin America faced an average of 3,813 cyber attacks per week — a toll that climbed 35 per cent against the prior year's figures, placing the region ahead of all others in attack volume. The Africa region posted 3,701, placing it one step ahead of Asia-Pacific, which recorded 3,593.
At the regional level, the steepest year-on-year climb belonged to Europe, where the count of attacks ran 61 per cent above figures logged during the corresponding month twelve months earlier. The region logged a 50 per cent uptick across that same stretch.
Findings from the dataset pointed toward an expanding set of hazards tied to how generative AI is being used in professional settings. Roughly one out of every 39 prompts submitted to enterprise generative AI tools carried a high likelihood of exposing confidential data, with nearly nine in ten organisations that relied on these platforms recording at least one such instance.
Roughly one in seven prompts was found to include information that could be considered sensitive. Across the month in question, a typical individual submitted 131 prompts to generative AI tools, while the organisations surveyed drew on eight such tools apiece.
Among the data categories turning up in generative AI prompts, network and IT infrastructure information led the way at 71 per cent of organisations surveyed, with financial records close behind at 70 per cent, legal and regulatory material at 68 per cent, employee and HR details at 62 per cent, and personally identifiable information at 60 per cent.
Among industry segments, the business services category carried the steepest share of high-risk generative AI prompt exposure, with roughly one in every 20 prompts — equivalent to a 4.9 per cent rate — falling into that classification. Trailing not far behind, the healthcare and medical sector posted a 3.5 per cent rate, while financial services came in somewhat higher at 4.1 per cent.
Among all regions tracked, Latin America recorded the steepest share of generative AI prompts flagged as high-risk, with that figure landing at 4 per cent — outpacing a worldwide average that stood at 2.5 per cent.
Phishing and other inbox-based tactics held their place as a leading point of entry for attackers. Phishing messages accounted for roughly 1.1 per cent of all email traffic recorded that September — about one in every 91 messages — up from a 0.89 per cent share, or one in 112, the previous month.
Hyperlinks accounted for the vast majority of phishing attempts — roughly eight in ten — while file attachments appeared in about one in nine cases, establishing embedded URLs as the dominant vehicle for email-borne threats across that reporting period.
Of the regions included in the analysis, North America recorded the highest phishing exposure rate, with approximately one in every 79 inbound emails identified as a phishing attempt, placing the regional figure at 1.26 per cent. Among the sectors tracked, trade groups and nonprofits posted the steepest rate at 2.17 per cent, with construction and engineering close behind at 2.05 per cent, while real estate, rentals, and leasing recorded 1.38 per cent.
Tallies of ransomware incidents logged in September reached 824, a figure that stood 53 per cent above the equivalent count from twelve months prior. Among the sectors that logged complaints, business services drew the largest share at 31.3 per cent, with consumer goods and services placing second at 15.2 per cent and industrial manufacturing accounting for roughly one in nine of the total at 11 per cent.
Ransomware disclosures were concentrated most heavily in North America, which held a 46 per cent share, with Europe responsible for roughly a quarter of cases at 25 per cent and Asia-Pacific accounting for the remaining 17 per cent.
Ransomware data from the period placed The Gentlemen at the top of the frequency count, with their attacks making up 13 per cent of all published incidents. Akira's share landed at 5 per cent, with Qilin drawing roughly double that proportion at 9 per cent. Beyond the dominant players, roughly 80 further extortion collectives filed ransomware claims over the same period, a figure that points to how fragmented and fluid the threat environment has become.
Data research findings published by Check Point Research for the month of September pointed to a broadening of cyber threats across both their frequency and scope, according to Omer Dembinsky, who holds the role of Data Research Manager at the organisation. Dembinsky noted that threat data gathered across every part of the world points to a pattern where phishing incidents have grown more frequent, ransomware activity has held at elevated levels, and the spread of generative AI tools has coincided with greater exposure of sensitive information — conditions that leave organisations relying on disconnected defences poorly positioned to respond.
Dembinsky further noted that organisations that weave together network monitoring, cloud infrastructure, endpoint protection, email filtering, and AI activity tracking — unifying live visibility, hands-on control, and automated response into a single operational layer — gain the ability to catch threats before they take hold, rather than absorbing the costs of a breach or service disruption after the fact.
