AI-driven phishing attacks expose employee data at major enterprises
SpyCloud reported that AI-generated phishing attacks and phishing-as-a-service platforms are enabling threat actors to expose employee data at scale, reportedly compromising 86% of Fortune 100 companies and 47% of FTSE 100 companies over a 12-month period. Most targeted organizations struggle to detect, respond to, and remediate phishing attacks quickly.
What happened
SpyCloud's 2026 Phishing Pulse Report, released June 17, 2026, found that phishing attacks exposed employee data at 86% of Fortune 100 companies over the last 12 months, while phishing attacks exposed employee data at nearly half (47%) of FTSE 100 companies over the same period.
78% of surveyed organizations with more than 1,000 employees experienced an increase in phishing volume over the past 12 months, while 84% report that AI-generated phishing attacks are becoming more prevalent or harder to defend against.
Reported impact
Technology companies experienced the highest level of phishing exposure among Fortune 100 companies, followed by the airline and automotive industries. Among FTSE 100 companies, energy companies experienced the highest level of phishing exposure, followed by telecommunications and financial services.
Only 38% of organizations are very confident they can detect and respond to credential theft within 24 hours. 58% struggle to identify which credentials or session tokens were exposed following a phishing incident, 42% struggle to remediate exposed users at scale, and 68% require 4 hours or longer to identify and remediate confirmed phishing-related exposures.
Index analysis
SpyCloud's analysis indicates that artificial intelligence and phishing-as-a-service (PhaaS) platforms enable threat actors to launch highly effective campaigns at scale, with AI-generated lures and adversary-in-the-middle (AiTM) techniques allowing attackers to capture not only usernames and passwords, but session cookies and refresh tokens.
Only 30% of organizations have fully integrated phishing detection with identity response workflows.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.