Undisclosed attacks now dominate ransomware activity, with 2,027 incidents logged in the quarter and data theft reported in 97% of disclosed cases.