Ransomware · 3 days ago
Black Kite says manufacturing stayed ransomware’s top target, accounting for 22% of all victims in the period from April 2025 to March 2026. The same study found manufacturing incidents rose about 40% year over year in H1 2026, from 847 to 1,183.
The pattern is about leverage: ransomware crews keep aiming where outages hurt, and manufacturing gives them production stoppage, delivery delays, and IT-OT convergence they can use to widen the blast radius. Black Kite also says Europe’s manufacturing victim count jumped 85.4% in the first seven months of 2026 while US counts were roughly flat, and The Gentlemen, first seen in September 2025, quickly built manufacturing into 23% of its leak-site listings.
For organizations where corporate IT and plant networks are connected, the exposure is not just the first infected machine but the downtime pressure that can spread into operations, suppliers, and customers. The report suggests the current campaign mix is following industrial concentration and shutdown leverage more than a generic worldwide wave.
3 sources covering this story
New Black Kite report discloses that manufacturing ransomware surged in 2026, spreading beyond the US, with 1,183 victims through July.
Manufacturing Accounts for 22% of all Ransomware Victims
Black Kite has found that manufacturing remained the most targeted sector for ransomware attacks, and saw a big jump in incidents in H1 2026
Ransomware Attacks on Manufacturers Surge as Supply Chain Risk Grows
Research shows attacks on manufacturers rose 40% in early 2026, as ransomware groups increasingly exploit the supply-chain disruption caused by operational shutdowns.
Part of the PlainSec briefing for 2026-09-21