In August 2026, Brazil ranked sixth worldwide in ransomware claims — 23 cases claimed by criminal groups that month, tied with Mexico, according to ThreatVectr’s monitoring of Ransomware.live data.
Most hit companies get their files back. The Sophos Ransomware Report 2026, based on IT and security leaders at Brazilian companies attacked in the past year, found that 85% used backup to restore encrypted data — up from 73% in 2025.
The file comes back. The question left standing is different: what exactly happened, on each machine, between the intruder getting in and the backup kicking in?
That question doesn’t go away once the ransom is paid. Internal audit, the insurer, and — when personal data is involved — Brazil’s data protection authority (ANPD) all ask it eventually.
Companies without a ready answer usually find that out at the worst possible time: in the middle of a forensic review, a policy negotiation, or a formal information request.
An attack that grew, not one that faded
Between January and August 9, 2026, Brazilian companies logged 123 claimed ransomware attacks, against 148 for the whole of 2025. At the current pace, 2026 closes well above the prior year. Ransomware has firmly joined the short list of IT failures that are the costliest to reverse in large deployments.
Globally, 1,070 organizations were claimed in August 2026 alone, up roughly 10% from July — the figure comes from ThreatVectr. This isn’t a one-off spike. It’s a new baseline.
For whoever runs a large fleet, the number that matters isn’t the world ranking. It’s the growing odds that the next line in that statistic carries the company’s own name — and whether every machine in that fleet is actually accounted for when the question gets asked.
Backup fixes the file. It doesn’t answer the question.
The median ransom demand in Brazil rose 63% in a year, from US$392,500 in 2025 to US$640,000 in 2026, according to Sophos. In 56% of attacks, data was actually encrypted.
Paying, or restoring from backup, gets the file back. It doesn’t return the reconstruction of what happened on every machine that was touched.
What backup never gives back
- Where the intruder got in — and whether that door is still open.
- Which machines had files altered, copied, or deleted, and in what order.
- Whether data was exfiltrated before encryption, and which data.
- Which credential was used, by whom, and when.
The response has to hold up as proof, not as a hunch.
Without those answers, the internal process closes with a hunch. That’s what’s left when the recovered file is the only evidence on hand.
Insurers ask for the same reconstruction before releasing coverage. And if any of the touched files held personal data, the requirement is no different: show what was accessed, when, and by whom — on record, not by estimate.
None of that shows up in a backup log. A backup tool knows which files it restored. It has no idea which ones were opened, copied, or read by someone who shouldn’t have had access in the first place.
The entry point is still the simplest one
Malicious email remains the most common technical cause of ransomware in Brazil, present in 37% of attacks, per Sophos. Exploited vulnerabilities fell from 44% to 24% over the same period; phishing accounts for another 18%.
A good share of the unauthorized access that follows runs through trivial gaps — a forgotten network folder left open to an entire department, for instance. Enforcing endpoint security policy lowers the odds of getting in. It doesn’t replace knowing what happened once someone gets in anyway.
Phishing training helps. Patching a known vulnerability helps more. Neither guarantees the next attempt fails — and that’s exactly the scenario the reconstruction needs to be ready for in advance, not improvised afterward.
How Tz0 Forensics reconstructs what happened
Tz0 Forensics installs a tracking agent on the workstation that logs activity — file changes, browsing, resource use, messenger conversations — and reconstructs deleted files, identifying who altered, created, or removed each folder.
During use of a financial, accounting, or remote-access tool, it records the session second by second. A programmable alert fires on a suspicious event, with screen capture, video, and audio attached as evidence. It also offers native password recovery for more than 300 mechanisms — browser, FTP, and email client.
Investigation follows five steps: authorize, with a defined scope; collect, silently; preserve, on the server; analyze; and export as an evidence package for the process — internal, insurance, or regulatory.
The web console searches by keyword: a search for “payment,” for example, returns the records with machine, person, program, and window involved. That’s the difference between saying “something happened on that machine” and pointing to exactly what, with whom, and when.
If the incident happened today, would the answer be ready?
A paid ransom, or a restored backup, closes the operational problem. It doesn’t close the question that audit, the insurer, or the regulator will ask about every machine that was touched.
Whoever already knows how to reconstruct what happened answers that question with proof. Whoever doesn’t, answers with a hunch — or doesn’t answer at all.
This isn’t something to sort out after the incident. The tracking agent needs to be installed, silent collection needs to be active, and the chain of custody needs to exist before any alert ever fires — otherwise the data is missing exactly when it matters most. Request a Trauma Zer0 evaluation and see what your fleet is recording today.