Daily AI brief · October 16, 2026
AI Played a Part in 84% of Ransomware Attacks
A new survey says AI showed up in 84% of ransomware attacks victims described, often through their own AI tools, and Meta's new terms let it train AI on websites tied to business pages starting October 30.
Survey: AI played a part in 84% of ransomware attacks, and often it was the victim's own (Semperis, Let's Data Science, Straight Arrow News, Cybersecurity Insiders) Semperis, an identity security company, released its 2026 Ransomware Risk Report on Wednesday, a survey of 1,200 IT and security professionals in nine countries. Victims said AI was involved in some way in 84% of the ransomware attacks they described, and 44% said attackers used their own AI agents or systems against them to reach more of the network. Attackers got into logins and account systems in 87% of attacks, 59% of victims said they paid a ransom, and 37% said attackers threatened employees' friends or family. Keep the source in mind: it's a vendor survey of people's experiences with no breakdown by company size, and it doesn't prove AI caused any single attack. Still, if you run the office, the useful part is the 44%: an AI assistant connected to your email, files or customer list carries your permissions, so anyone who takes over that account or that tool gets them too. The fewer tools hold the keys, the smaller the damage when one goes wrong.
Meta's new business terms let it train AI on your website starting October 30 (Nieman Lab, AI Weekly) Meta's updated commercial terms take effect October 30, and they let Meta crawl websites "associated with" any business account on Facebook, Instagram or WhatsApp and use what it collects to train its products, which include its AI. Nieman Lab reports there is no way to opt out: a business that keeps using Meta's tools for business after that date has agreed. Legal experts told Nieman Lab the wording could reach past paywalls and around the usual "please don't crawl" instructions on a site, though nobody knows yet whether a court would enforce it, and Meta declined to answer questions. The reporting focuses on news sites, but the terms cover every business account. The practical part for a small business: if your website holds work you sell, like original photos, recipes, design guides or detailed how-to pages, assume that from October 30 it can end up in Meta's AI, and decide now whether that trade is worth keeping your business page.
Make the list of what's plugged in. Sit down with whoever handles your accounts and write down every AI tool and outside app connected to company email, calendars, files and your customer list. In Microsoft 365 or Google Workspace, your admin can see which apps have been given access. Remove anything nobody has used in a month, and make sure every account that can still reach company data has two-step sign-in turned on.
If you run a marketing or consulting shop: walk through how a client's blog post or portfolio piece gets published and then shared from their Facebook page. That's the moment Meta's new terms reach it. Before October 30, add one step to the workflow: a person checks with each client whether any page on their site holds paid or original material they don't want used for AI training, and you agree in writing what happens next. The AI can draft the client note; the decision stays with the client.
Skip the panic delete. Leaving Facebook or Instagram before the 30th will cost most small businesses more customers than it protects. Read the terms with whoever runs your site, move truly valuable material behind a login or off the public site, and revisit once lawyers and courts weigh in.
Where it's going: Every account your business connects, to an AI tool or a platform, now comes with fine print about what it may do with your data, so the businesses that keep a short list of what's plugged in will spend far less time cleaning up after it.
- AI in 84% of ransomware attacks: [Let's Data Science, Oct 14](https://letsdatascience.com/news/semperis-report-says-ai-was-weaponized-in-84-of-surveyed-ran-7575d4dc) · [Straight Arrow News](https://san.com/cc/ai-is-letting-just-about-anyone-become-a-cybercriminal-report/) · [Cybersecurity Insiders](https://www.cybersecurity-insiders.com/study-finds-ai-involved-in-more-than-84-of-ransomware-attacks/)
- Meta's October 30 terms and website crawling: [Nieman Lab, Oct 2026](https://www.niemanlab.org/2026/10/metas-new-commercial-terms-will-allow-the-scraping-of-news-sites-legal-experts-say/) · [AI Weekly, Oct 15](https://aiweekly.co/alerts/metas-oct-30-terms-let-it-scrape-news-sites-legal-experts-say) · [daily.dev](https://daily.dev/posts/business-accounts-will-consent-to-meta-scraping-their-websites-starting-oct-30-kxir8q3rd)