--- title: "Steal, Deal, Repeat: 26B files leaked, one way | Firevault" description: "Everything Europol warned about, Firevault was built to stop. Europol has just released its most damning assessment yet of cybercrime in the digital age. The…" lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault has rewritten the rules for data protection & storage via its offline secure storage (OSS) platform, for users to vault everything that matters.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": "GB" } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault has rewritten the rules for data protection & storage via its offline secure storage (OSS) platform, for users to vault everything that matters.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/news/steal-deal-repeat-26-billion-files-54-click-rates-one-way-out#webpage", "url": "https://fire-vault.com/news/steal-deal-repeat-26-billion-files-54-click-rates-one-way-out", "name": "Steal, Deal, Repeat: 26B files leaked, one way", "description": "Everything Europol warned about, Firevault was built to stop. Europol has just released its most damning assessment yet of cybercrime in the digital age. The…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/dc727f35-775a-469f-9c5c-94f6e1c0dabb/steal-deal-repeat-1771248364335-2x.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/news/steal-deal-repeat-26-billion-files-54-click-rates-one-way-out#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/news/steal-deal-repeat-26-billion-files-54-click-rates-one-way-out#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Learn", "item": "https://fire-vault.com/learn" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "Steal. Deal. Repeat. 26 Billion Files, One Way Out", "item": "https://fire-vault.com/news/steal-deal-repeat-26-billion-files-54-click-rates-one-way-out" } ] }, { "@context": "https://schema.org", "@type": "NewsArticle", "headline": "Steal. Deal. Repeat. 26 Billion Files, One Way Out", "description": "Everything Europol warned about, Firevault was built to stop. Europol has just released its most damning assessment yet of cybercrime in the digital age. The…", "url": "https://fire-vault.com/news/steal-deal-repeat-26-billion-files-54-click-rates-one-way-out", "image": [ { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/dc727f35-775a-469f-9c5c-94f6e1c0dabb/steal-deal-repeat-1771248364335-2x.jpg", "width": 1200, "height": 1200 }, { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/dc727f35-775a-469f-9c5c-94f6e1c0dabb/steal-deal-repeat-1771248364335-2x.jpg", "width": 1200, "height": 900 }, { "@type": "ImageObject", "url": "https://fire-vault.com/__l5e/assets-v1/dc727f35-775a-469f-9c5c-94f6e1c0dabb/steal-deal-repeat-1771248364335-2x.jpg", "width": 1200, "height": 675 } ], "thumbnailUrl": "https://fire-vault.com/__l5e/assets-v1/dc727f35-775a-469f-9c5c-94f6e1c0dabb/steal-deal-repeat-1771248364335-2x.jpg", "author": { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Director & Co-Founder", "worksFor": { "@id": "https://fire-vault.com/#organization" }, "url": "https://fire-vault.com/why-oss/about" }, "publisher": { "@type": "NewsMediaOrganization", "name": "Firevault", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 600, "height": 60 } }, "datePublished": "2025-06-17T06:04:59+00:00", "dateModified": "2026-08-28T08:03:22.256672+00:00", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/news/steal-deal-repeat-26-billion-files-54-click-rates-one-way-out" }, "inLanguage": "en-GB", "articleSection": "News", "wordCount": 1075, "keywords": "Steal., News, data breach, cyber security, offline secure storage, data protection, physical air gap", "articleBody": "Everything Europol warned about, Firevault was built to stop. Europol has just released its most damning assessment yet of cybercrime in the digital age. The IOCTA 2025 report, titled Steal, Deal and Repeat, exposes the industrial-scale exploitation of data by criminal groups. It outlines a fully operational economy where access credentials, session tokens, private files, and even identities are b", "dateline": "United Kingdom", "speakable": { "@type": "SpeakableSpecification", "cssSelector": [ "h1", ".article-summary", "h2" ] }, "isAccessibleForFree": true, "copyrightHolder": { "@id": "https://fire-vault.com/#organization" }, "copyrightYear": 2025 } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o)[2026 PowerSchool 62.4M records ](https://www.bleepingcomputer.com)[2026 DISA Global Solutions 3.3M records ](https://techcrunch.com)[2026 Globe Life 850K records ](https://www.securityweek.com)[2026 Lidl GB Customer contact data ](https://www.theguardian.com/business/2026/jun/11/lidl-gb-third-party-data-breach)[2026 Asahi Group Production systems disrupted ](https://www.reuters.com/technology/cybersecurity/asahi-says-cyberattack-disrupted-operations-japan-2025-09-29/)[2026 Kido International 8K records ](https://www.bbc.co.uk/news/articles/c623d7v0e5xo)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](https://www.bbc.co.uk/news/articles/c789e7l1z7po)[2026 Jaguar Land Rover Production and IT systems disru... ](https://www.bbc.co.uk/news/articles/cx2gx8p3rzeo)[2026 Peter Green Chilled Order and logistics data ](https://www.bbc.co.uk/news/articles/c0k7yy8n3g5o)[2026 Adidas UK Customer contact details ](https://www.bbc.co.uk/news/articles/c78jkev1el2o) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) [Knowledge Vault](/learn/knowledge)/ [News](/learn/knowledge?filter=news) News · 17 June 2025 # Steal. Deal. Repeat. 26 Billion Files, One Way Out Everything Europol warned about, Firevault was built to stop. Europol has just released its most damning assessment yet of cybercrime in the digital age. The… ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) Mark Fermor Director & Co-Founder, Firevault 6 min read Share [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fsteal-deal-repeat-26-billion-files-54-click-rates-one-way-out)[](https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Fnews%2Fsteal-deal-repeat-26-billion-files-54-click-rates-one-way-out&text=Steal.%20Deal.%20Repeat.%2026%20Billion%20Files%2C%20One%20Way%20Out%0A%0AEverything%20Europol%20warned%20about%2C%20Firevault%20was%20built%20to%20stop.%20Europol%20has%20just%20released%20its%20most%20damning%20assessment%20yet%20of%20cybercrime%20in%20the%20digital%20age.%20The%E2%80%A6)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Fnews%2Fsteal-deal-repeat-26-billion-files-54-click-rates-one-way-out)[](mailto:?subject=Steal.%20Deal.%20Repeat.%2026%20Billion%20Files%2C%20One%20Way%20Out&body=Everything%20Europol%20warned%20about%2C%20Firevault%20was%20built%20to%20stop.%20Europol%20has%20just%20released%20its%20most%20damning%20assessment%20yet%20of%20cybercrime%20in%20the%20digital%20age.%20The%E2%80%A6%0A%0Ahttps%3A%2F%2Ffire-vault.com%2Fnews%2Fsteal-deal-repeat-26-billion-files-54-click-rates-one-way-out) ![Rows of filing cabinets in a dimly lit archive with one drawer pulled open](/__l5e/assets-v1/dc727f35-775a-469f-9c5c-94f6e1c0dabb/steal-deal-repeat-1771248364335-2x.jpg) Rows of filing cabinets in a dimly lit archive with one drawer pulled open Why it matters ## What this means for organisations holding critical data Everything Europol warned about, Firevault was built to stop. Europol has just released its most damning assessment yet of cybercrime in the digital age. The… In this analysis **On this page** Everything Europol warned about, Firevault was built to stop. Europol has just released its most damning assessment yet of cybercrime in the digital age. The **IOCTA 2025 report,** titled Steal, Deal and Repeat, exposes the industrial-scale exploitation of data by criminal groups. It outlines a fully operational economy where access credentials, session tokens, private files, and even identities are bought, sold, and resold like commodities. And the numbers are staggering. According to the report, over 26 billion digital files were stolen in 2024 alone. Phishing emails powered by AI now outperform human-written scams, with click-through rates exceeding **54%.** Criminals no longer need to break in they simply log in using harvested or purchased access. This is the reality: if your data is online, you are already part of the problem Europol is describing. **[Firevault](/)** exists to offer a radical alternative one that removes your most valuable information from the internet entirely. **The Criminal Marketplace Runs on Your Data** Today’s cybercriminals don’t behave like lone wolves. They operate like organised businesses. Europol confirms that Initial Access Brokers IABs now wholesale entry to compromised systems. These actors don’t exploit the data themselves. Instead, they sell access rights to others who do: ransomware gangs, fraud networks, or nation-state threat actors. What makes this even more dangerous is the repeat nature of the trade. Once your data is breached, it enters a marketplace where it can be bought and reused over and over again. The same email address, login token, or PDF file could pass through multiple hands each time used to extract more information, deploy more malware, or engineer more trust-based fraud. Europol is clear: this isn’t a scattergun threat landscape it’s a structured, scalable economy built on repeat exploitation. **AI Makes It Easier for Criminals and Harder for You** One of the most alarming insights from the report is how artificial intelligence has reshaped social engineering. Criminals are now using generative AI tools to write phishing emails that are linguistically sophisticated, hyper-personalised, and disturbingly persuasive. These messages are tailored to your language, industry, and context and they’re working. Phishing messages crafted by AI are now four times more effective than those written by humans. They’re used to impersonate CEOs, colleagues, lawyers, and even IT staff. Europol also confirms that AI-generated voice deepfakes are increasingly being deployed in live calls, helping criminals bypass identity checks and trick users into granting access to financial systems, file shares, or internal platforms. This isn’t speculation. These tactics are already in play. And they are working on individuals and businesses every single day. **Encryption Isn’t Saving You, It’s Helping Them** There’s a dangerous misconception that encryption is the ultimate shield. But Europol’s report reveals a darker truth: end-to-end encryption is now routinely used by criminals to conduct business in secrecy. Encrypted messaging apps have become operational hubs for ransomware negotiations, data sales, phishing kit subscriptions, and child exploitation material. These platforms once heralded as privacy breakthroughs now serve as encrypted black markets where law enforcement can’t see in, and attackers can communicate with total confidence. What you see as security, they use as cover. This is why Firevault doesn’t rely on networked encryption. We don’t just hide your data, we remove it from the online environment altogether. **Cloud Syncing. Always connected Is a Criminal’s Dream Come True** Europol is unequivocal: the cloud has become the weakest link in the security chain. Always-on syncing, browser auto-fill, and automatic backup services may feel convenient, but they create a perfect storm for criminals using infostealers malware designed to quietly collect every piece of data you store or access. Once these tools are installed, even briefly, they can harvest crypto wallets, scanned IDs, PDF contracts, financial spreadsheets, private recordings, and browser-stored passwords. The data is then uploaded to dark web marketplaces where it is sold, often in bulk to buyers who use it for blackmail, fraud, or extortion. And because most victims don’t realise they’ve been compromised, these same files are often resynced, re-indexed, and re-exploited, making the cycle of exposure endless. **Online Storage has sadly become the target** Even businesses with robust IT policies are exposed. Europol highlights how attackers are now exploiting browser cookies to bypass two-factor authentication, using AI-generated resumes to get hired into trusted roles, and launching malware directly through fake “support” pop-ups on legitimate websites. Insider threats have surged. Attackers aren’t just breaching systems from the outside they’re applying for jobs inside companies and compromising them from within. This is why Firevault doesn’t rely on firewalls, monitoring tools, or patch cycles. We remove your most sensitive data from the equation entirely. If it doesn’t exist in the cloud, it can’t be infected, hijacked, or exploited. It becomes invisible. **Firevault: Goes offline against the threats EUROPOL highlight** Where most digital security solutions try to outsmart attackers, Firevault takes a different approach: we remove your data from the battlefield. Firevault is the world’s first fully offline, identity-locked vault designed specifically for high-value digital assets. Your files are stored physically, disconnected from the internet, with no interface, no cloud layer, and no metadata trail. Only you, and those you trust can unlock it using identity verification and physical control. There are no IP addresses. No login screens. No packets to sniff. No endpoints to exploit. Nothing to breach, because nothing is online. **If You’re Online, You’re Already Exposed** Europol’s report should serve as a final wake-up call. It confirms what many already suspect: the online world is no longer secure by default. Every new tool from single sign-on to AI-enhanced platforms increases your exposure. Every new device expands your attack surface. And if you’re still syncing your most valuable data, ID documents, crypto wallets, legal contracts, unreleased projects you’re gambling with the assumption that no one has noticed. But the truth is, the criminals noticed years ago. And they’re already trading access to people just like you. **Firevault Is the Exit Ramp** Firevault isn’t a feature. It’s a decision. It’s the point where you stop pretending you’re invisible just because you’ve got a password, and instead choose to become truly unreachable. We don’t just offer encryption. We offer removal from the criminal supply chain. Your most sensitive data doesn’t just become secure it becomes inaccessible to everyone but you. Create Your Vault. Disconnect to Protect. If you’re ready to break the cycle of Steal. Deal. Repeat., Firevault is the only way out. [🔐](/create) [Create Your Vault Now](/create) 📄 [Download Europol’s Full IOCTA 2025 Report](https://www.europol.europa.eu/cms/sites/default/files/documents/Steal-deal-repeat-IOCTA_2025.pdf) About the author ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) ### Mark Fermor [](https://www.linkedin.com/in/mfermor) Director & Co-Founder Co-founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. The Firevault view**Offline Secure Storage® keeps a clean copy beyond the reach of an attacker.**[Why #OSS →](/why-oss) Control systems and access**Cut the physical paths attackers and third parties depend on.**[Explore Control →](/solutions/control) Get started**Get started, or talk to a member of the team.**[Get started →](/get-started) How Firevault would handle this ## A recovery copy an attacker cannot reach Offline Secure Storage® keeps a clean copy of your data on hardware that is physically disconnected, so backup and recovery do not depend on systems an intruder can touch. [Get started](/get-started)[Talk to the team](/demo) **Hardware**Your copy sits on dedicated encrypted hardware **Disconnect**Offline by default, connected only when you say so **Recovery**A known-clean copy to rebuild from, on your timetable **Location**Held in a secure Firevault Bunker Related Reading ## You may also find these useful [ ![Firevault Awarded Cyber Essentials and Cyber Essentials Plus Certification](/__l5e/assets-v1/446b675b-b48b-4b8e-ba01-b97ad3abf97d/firevault-cyber-essentials-plus-certified-2x.jpg) News ### Firevault Awarded Cyber Essentials and Cyber Essentials Plus Certification Firevault has been awarded Cyber Essentials and Cyber Essentials Plus certification, the UK Government-backed scheme run by the NCSC, following an independent technical audit of its systems and controls. 26 Jul 2026 2 min ](/news/firevault-cyber-essentials-plus-certified)[ ![Russian hackers steal UK government logins: why offline vaults change the equation](https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/article-images/news%2Frussian-hackers-uk-government-logins.jpg) News ### Russian hackers steal UK government logins: why offline vaults change the equation The Telegraph reports that Russian-linked hackers have harvested UK government login credentials and traded them on dark-web forums. The incident is a reminder that credentials, however well protected in the cloud, remain the single point of failure that offline data vaults are designed to remove. 7 Jul 2026 4 min ](/news/russian-hackers-steal-uk-government-logins-offline-vaults)[ ![Great Marlow School partially closed after cyber attack](/news/great-marlow-school-cyber-hero.jpg) News ### Great Marlow School partially closed after cyber attack A malware incident has shut down ICT systems at Great Marlow School in Buckinghamshire, cancelling lessons and silencing parent communications. Here is what it tells us. 14 Jun 2026 4 min ](/news/great-marlow-school-cyber-attack-partial-closure)[ ![School Ransomware: Files Must Live Offline](/__l5e/assets-v1/5dcdf155-e287-48e8-bf9b-82b9837b80d0/school-ransomware-safeguarding-2x.jpg) News ### School Ransomware: Files Must Live Offline St Anne's Catholic School in Southampton was shut for four days after ransomware hit its network. It is not the first school to be targeted. From nurseries to councils, sensitive safeguarding data remains dangerously exposed on connected systems. 27 Mar 2026 7 min ](/news/st-annes-southampton-ransomware-safeguarding-files-physically-offline)[ ![TfL Hack: 10 Million Records Stolen](/__l5e/assets-v1/77ff397a-d530-4aee-88e3-5098513ae34e/tfl-hack-10-million-scattered-spider-2x.jpg) News ### TfL Hack: 10 Million Records Stolen Transport for London has confirmed that around 10 million customer records were stolen during the 2024 Scattered Spider cyber attack, making it one of the largest data breaches in British history. The revelation raises urgent questions about transparency, regulatory accountability and the case for offline secure storage. 11 Mar 2026 5 min ](/news/tfl-hack-10-million-records-stolen-scattered-spider)[ ![Firevault: 2025 Tech Trailblazers Shortlist](/__l5e/assets-v1/c2acabab-9ada-4969-9d69-b18478181083/firevault-shortlisted-trailblazers-v2-1771248067838-2x.jpg) News ### Firevault: 2025 Tech Trailblazers Shortlist We’re proud to announce that Firevault Limited has been shortlisted for the 2025 Tech Trailblazers Awards, recognised in the Firestarter category. For a young… 29 Nov 2025 6 min ](/news/firevault-shortlisted-for-the-2025-tech-trailblazers-firestarter-award) ## Suggested Reading - [What is Offline Secure Storage The foundation of physical disconnection ](/offline-secure-storage/what-is-oss) - [Why Offline Secure Storage The case for physical control ](/why-oss) - [Ransomware Defence Hold gold copies offline ](/oss-for-ransomware-recovery) - [Control Physical path control for IT and OT ](/solutions/control) - [Knowledge Vault All articles, guides and whitepapers ](/learn/knowledge) - [Book a Demo See Firevault in action ](/demo) [Back to Knowledge Vault](/learn/knowledge)