Ransomware Attacks on Manufacturers Rise Sharply in 2026

The manufacturing sector continued to experience a high volume of ransomware attacks in 2026, according to newly published data. Black Kite released its 2026 Manufacturing & Distribution Ransomware Report on September 17, 2026, highlighting ongoing risks for manufacturers worldwide.

During the first seven months of 2026, the number of publicly disclosed ransomware victims in manufacturing reached 1,183, surpassing totals from both 2023 and 2024. The report stated that manufacturing remained the most targeted industry for ransomware for the fourth year in a row, accounting for 22% of all reported cases in 2026.

In total, 1,660 manufacturing organizations were identified as ransomware victims in 2026, representing a substantial portion of overall disclosures. The median revenue of affected companies was $42.9 million, with about 70% of those with known revenue falling between $10 million and $100 million.

Ransomware incidents in the manufacturing sector increased by nearly 40% in the first half of 2026 compared to the previous year. The data also showed a notable shift in the geographic distribution of victims, as European manufacturing ransomware cases rose by 85.4%, reducing the U.S. share of global manufacturing victims from 52.3% to 34.8%.

What the numbers show

• 1,183 manufacturing ransomware victims were reported in the first seven months of 2026.
• Manufacturing accounted for 1,660 ransomware victims in 2026.
• Germany saw an increase of more than 83% in manufacturing ransomware victims in early 2026.

Nearly half of the manufacturing ransomware incidents in 2026 were linked to threat actor groups that were not present in Black Kite’s dataset in 2023 or 2024. The group known as 'The Gentlemen' first appeared in the dataset in September 2025 and had claimed 142 manufacturing victims by mid-2026, with manufacturing making up 23.1% of the group’s activity.

Analysis of the Ransomware Susceptibility Index (RSI) revealed that 74.4% of manufacturing ransomware victims had an RSI above 0.4 at the time of disclosure, and 35.1% had an RSI of 0.6 or higher. These figures indicate a concentration of incidents among organizations with higher susceptibility scores.

Germany experienced a marked increase in manufacturing ransomware cases, with victims rising by more than 83% in the first seven months of 2026 compared to the same period in 2025. This contributed to the overall growth in European cases and the shift in the global distribution of attacks.

The report also noted that many of the affected manufacturing organizations were mid-sized, with the majority of known victims generating annual revenues between $10 million and $100 million. This trend continued from previous years, as manufacturing remained the top target for ransomware attacks globally.

* This article is based on publicly available information at the time of writing.