Manufacturing’s position at the top is consistent across Black Kite’s broader ransomware research. Black Kite’s 2026 Ransomware Report, covering April 2025 through March 2026, identified 7,551 publicly disclosed ransomware victims across all industries, and manufacturing held the top position for the fifth consecutive year with 1,660 victims, 22 percent of all disclosures. Manufacturing remained the top target every year Black Kite tracked ransomware activity, since 2021.
The incidents that reach the news involve companies everyone knows: Silent breweries at Asahi, and a cybersecurity incident that halted production lines at Nucor, the biggest steel manufacturer in North America. However, the dataset behind this report tells a quieter story. The typical manufacturing ransomware victim is a company few people outside its own supply chain have ever heard of.
Intense Pressure
Manufacturers and companies that move their products face more intense pressure from threat actors, according to the report entitled, “2026 Manufacturing & Distribution Ransomware Report: Still the #1 Target, but the Victim Profile Moved Downmarket and Overseas.”
“What makes manufacturing and distribution so attractive to ransomware operators is the immediate operational impact,” said Ferhat Dikbiyik, chief research and intelligence officer (CRIO) at Black Kite. “One successful attack can stop production lines and disrupt delivery commitments, and every hour of downtime strengthens the attacker’s negotiating position. But attackers don’t operate blindly. Their reconnaissance relies on externally visible signals, from unpatched systems and exploitable services to leaked credentials and misconfigured defenses.”
While ransomware activity is rising across industries, manufacturing stands apart for the consistency and pace of that growth. Ransomware attacks on manufacturers have more than doubled since 2023, and in the first half of 2026 alone, attacks increased nearly 40 percent year over year.
Each year in the chart counts January 1 through July 29 only, so 2026 is directly comparable rather than a partial-year total. The numbers show a 39.7 percent increase over the same period of 2025, which had itself grown 42.8 percent over 2024.
Source: Black Kite
Geography also plays a role in the ongoing growth of ransomware attacks as the footprint continues to widen. To that end, the report found there was a rise in European victims with an increase of 85.4 percent. Meanwhile, the U.S. share of global manufacturing ransomware victims fell from 52.3 percent to 34.8%.
Speaking of Europe, Germany saw significant growth. Manufacturing accounts for nearly 20 percent of the country’s economy, and ransomware victims in the sector increased by more than 83 percent in the first seven months of 2026 compared with the same period in 2025.
Ransomware Group
One group contributing to that attack pressure is SafePay. Black Kite’s European ransomware research previously identified the group’s concentration on German targets. SafePay accounted for 21.9 percen t of German manufacturing ransomware victims in 2025 and remains among the country’s most active ransomware groups in 2026.
Right now, the primary target for ransomware groups is the mid-market. The median ransomware victim generates $42.9 million in annual revenue, and from 2023 through the first half of 2026, 73 percent of ransomware attacks in North America and Europe hit mid-market companies.
For manufacturing, that concentration carries broader implications. Mid-sized manufacturers often sit within the supplier networks of larger enterprises, meaning attacks on the mid-market can create risk well beyond the initial victim. When suppliers are the primary target, a manufacturer’s vendor ecosystem becomes part of its attack surface.
Threat actor groups appear rebuilt, with the traditional heavy hitters replaced by Qilin, The Gentlemen, Akira, DragonForce, and INC Ransom. Among the new arrivals, The Gentlemen stands out for how quickly it found its footing in manufacturing.
First appearing in Black Kite’s dataset in September 2025, The Gentlemen claimed 142 manufacturing victims by mid-2026. Manufacturing now accounts for 23.1 percent of the group’s activity, one of the highest concentrations among major ransomware groups.
Key Findings
Key findings from the report:
- 1,183 manufacturing victims in seven months. The first seven months of 2026 produced more manufacturing victims than all of 2024, and same-period volume is up 39.7 percent year over year.
- 49.7 percent of 2026 incidents came from groups absent two years ago. Attacker threat groups rebuilt themselves in two years.
- 70.2 percent of manufacturing victims sit in the $10M to $100M revenue area. The mid-market carries the volume. The median victim generates $42.9 million in revenue, while the largest manufacturers continue to be hit every year.
- 85.4 percent growth in European victims. The U.S. victim count barely moved (443 to 412), so the drop in the U.S. share from 52.3 percent to 34.8 percent.
Click here to register for the report.