Black Kite

Ransomware attacks on manufacturers have more than doubled since 2023.

The average manufacturing or distribution ransomware victim scores 0.552 on the RSI.

In the first half of 2026, ransomware attacks on manufacturers increased nearly 40% year over year.

More than half of mid-market ransomware victims generate less than $50M in annual revenue.

Mid-market organizations accounted for approximately 72–75% of ransomware victims each year.

32.3% of mid-market organizations have at least one stealer log finding.

30.8% of ransomware victims carried KEV exposure.

18.5% of ransomware victims carried FocusTag signals.

The five largest ransomware actors controlled 43.6% of all victims.

In the last 16 months, nearly 70% of Europe's ransomware activity was concentrated in Germany, the United Kingdom, France, Italy, and Spain.

Manufacturing was the most-affected sector at 27.9% of ransomware victims.

Germany reported 370 ransomware incidents (17.9%), the United Kingdom reported 347 (16.8%), France repored 255 (12.3%), Italy reported 240 (11.6%), and Spain reported 203 (9.8%) among ransomware incidents across Europe.

Direct ransomware attacks on financial institutions spiked 76% year-over-year in Q1 2026.

Across all financial services vendors, 50.2% carry high-severity CVEs.

Over 48,000 CVEs were published globally in 2025, an 18% year-on-year increase.

Attackers exploited vulnerabilities an average of seven days before public disclosure in 2025.

More than 48,000 CVEs were published in 2025, an 18% increase year-over-year.

2,130 AI-related vulnerabilities were reported in 2025, a more than 200% increase since 2023.

Average downstream breach victims per vendor increased from 2.46 in 2021 to 5.28 in 2025.

An estimated 26,000 shadow victims remain impacted by vendor breach cascades but are never officially named.

433 million people are publicly disclosed as impacted by third-party breaches.

Among companies with less than $20 million, manufacturing is the second targeted industry at 17%.

Manufacturing remains ransomware's number one target. It has held the number one position for the fourth year in a row.

75% of manufacturing companies have critical vulnerabilities with a CVSS score of 8 or higher.

Cl0p claimed responsibility for targeting companies using unpatched versions of Cleo's MFT products in December 2024.

65% of third-party vendors are not maintaining current patch levels, which exposes financial institutions to inherited risk from known vulnerabilities (CVEs) and potentially unpatched zero-day vulnerabilities in legacy technologies.

There were 156 disclosed ransomware victims in the financial sector in 2024.

The number of publicly disclosed victims saw a 25% increase from the previous year (between April 2024 and March 2025)2. This follows an 81% surge in the period before that.

There has been a 123% increase in ransomware attacks over two years.

Ransom payment values declined by 35%.

Over 4,400 of the disclosed CVEs in 2024 were classified as critical (CVSS 9.0+).

Over 20,000 of the disclosed CVEs in 2024 had a CVSS score of 7.0 or higher.

There was a 38% year-over-year increase in published CVEs.

General medical and surgical hospitals are the second-most-targeted industry group by ransomware, making up 22% of healthcare victims, followed by other health professionals offices, such as dentists and outpatient centres.

Types of healthcare providers targeted in 2024 were: Physicians' offices accounted for 25% of attacks, general medical and surgical hospitals accounted for 22% of attacks, other health professionals' offices (outpatient centres, family services etc) accounted for 9% of attacks, and dentists' offices accounted for 6% of attacks.

The most active ransomware groups targeting healthcare in 2024 were: Everest: 25% of attacks focused on healthcare organisations, INC Ransom: 21.7% of attacks focused on healthcare organisations, Monti: 20.8% of attacks focused on healthcare organisations, Rhysida: 18.5% of attacks focused on healthcare organisations, BianLian: 15% of attacks focused on healthcare organisations, Qilin: 14% of attacks focused on healthcare organisations, and Black Suit: 14% of attacks focused on healthcare organisations.

Manufacturing accounted for 22% of all publicly disclosed ransomware victims.

Same-period manufacturing ransomware volume is up 39.7% year over year.

SafePay accounted for 21.9% of German manufacturing ransomware victims in 2025.

The first seven months of 2026 produced more manufacturing ransomware victims than all of 2024.

From 2023 through the first half of 2026, 73% of ransomware attacks in North America and Europe hit mid-market companies.

The U.S. manufacturing ransomware victim count changed from 443 to 412.

The U.S. share of global manufacturing ransomware victims fell from 52.3% to 34.8%.

Ransomware victims in Germany's manufacturing sector increased by more than 83% in the first seven months of 2026 compared with the same period in 2025.

The Gentlemen have claimed 142 manufacturing victims by mid-2026.

Manufacturing accounted for 23.1% of The Gentlemen's activity.

There were 1,183 manufacturing victims in the first seven months of 2026.

49.7% of 2026 manufacturing incidents came from groups that were absent in 2023 and 2024.

The Gentlemen accounted for 12% of 2026 manufacturing incidents.

The median ransomware victim generates $42.9 million in annual revenue.