Black Kite says manufacturing stayed ransomware’s top target, accounting for 22% of all victims in the period from April 2025 to March 2026. The same study found manufacturing incidents rose about 40% year over year in H1 2026, from 847 to 1,183.
The pattern is about leverage: ransomware crews keep aiming where outages hurt, and manufacturing gives them production stoppage, delivery delays, and IT-OT convergence they can use to widen the blast radius. Black Kite also says Europe’s manufacturing victim count jumped 85.4% in the first seven months of 2026 while US counts were roughly flat, and The Gentlemen, first seen in September 2025, quickly built manufacturing into 23% of its leak-site listings.
For organizations where corporate IT and plant networks are connected, the exposure is not just the first infected machine but the downtime pressure that can spread into operations, suppliers, and customers. The report suggests the current campaign mix is following industrial concentration and shutdown leverage more than a generic worldwide wave.
Ransomware Attacks on Manufacturers Surge as Supply Chain Risk Grows
Research shows attacks on manufacturers rose 40% in early 2026, as ransomware groups increasingly exploit the supply-chain disruption caused by operational shutdowns.