The analytics company Surfshark has released a quarterly report documenting a global rise in compromised online accounts. In the third quarter of 2026, more than 121.8 million accounts were compromised worldwide—a 13.2% increase compared to the second quarter of the same year. This trend confirms a persistent pattern: cybercriminals are increasingly targeting the server infrastructure of major services rather than end-user devices, making data breaches massive and nearly unavoidable for the end consumer.
The UK: Epicenter of European Regression
The sharpest negative shift was recorded in the UK, where the number of compromised accounts more than doubled to 5.8 million, a 121.6% increase from the previous quarter. This surge allowed the United Kingdom to overtake France and secure the top spot for total breaches among European countries. Experts attribute the spike to several major incidents involving cloud service providers serving the British market.
Ukraine: From 47th to 6th Place Globally
The most notable movement in the global ranking was shown by Ukraine, which jumped from 47th to 6th place in a single quarter. Over three months, 2.6 million Ukrainian accounts were compromised. According to Microsoft data, Ukraine has led the region in the number of cyberattacks for several quarters. The national CERT-UA service additionally reports massive phishing campaigns targeting Telegram and Signal users, creating an additional vector for credential compromise.
Estonia: Leader in Breach Density
When considering the metric per 1,000 residents rather than absolute numbers, Estonia ranked first globally, surpassing Australia, the USA, and the UK. The high level of societal digitalization and the concentration of IT infrastructure in a small-population country make density statistics particularly vulnerable to individual large-scale incidents. Nevertheless, this metric is most frequently used by regulators to assess the effectiveness of national cyber defense.
Why VPNs Do Not Save You and What Users Should Do
The key takeaway from the Surfshark report is that most massive breaches occur on company servers, not on end-user devices. This means that even premium VPN services cannot fully guarantee protection against data leaks, as the compromise happens on the service provider's side, not within the transmission channel. Under these circumstances, analysts recommend treating personal information as confidential and providing real data only on official resources; using pseudonyms, secondary email addresses, or email masking services for registration on less significant platforms; using reliable password managers so that a compromised access to one service does not expose the rest of your accounts; and subscribing to breach monitoring services for timely notification of new incidents.
Context: The Gorbag Group and Attacks on Military and Officials
The rise in breaches in Ukraine is happening against the backdrop of ongoing targeted operations by Russian hacker groups. Specifically, the activity of the Gorbag group, which specializes in stealing data from Ukrainian military and government officials, was previously documented. The combination of massive phishing campaigns, infrastructure attacks, and targeted compromises forms a multi-vector threat that, according to CERT-UA, cannot be neutralized solely through end-user security measures.
