Black Kite Finds Ransomware Still Prefers Mid-Market Manufacturers
Black Kite says 73% of ransomware victims since 2023 were mid-market firms, even as incidents rose 44% from 2023 to 2025. In its August report, the firm says manufacturing accounted for 26% of those victims, making it the top sector in the sample and the biggest share inside lower mid-market companies.
The pattern is simple: attackers keep hitting organizations that are big enough to pay and small enough to disrupt. In manufacturing, downtime and missed commitments can quickly become the pressure point, so a ransomware event lands as an operational interruption as much as a data problem.
For security and risk teams that support mid-market manufacturing, the exposure is not just the malware family of the month but the business profile ransomware keeps rewarding. The firms most at risk are the ones least able to absorb long triage or prolonged outage, and that is what keeps making them profitable targets.