Black Kite

The five largest ransomware actors controlled 43.6% of all victims.

7,551 publicly disclosed ransomware victims were identified between April 1, 2025 and March 31, 2026, a 24.9% increase from the previous reporting period.

There were 146 active ransomware groups by June 2026, including 61 new groups entering during the reporting period.

In the last 16 months, nearly 70% of Europe's ransomware activity was concentrated in Germany, the United Kingdom, France, Italy, and Spain.

Manufacturing was the most-affected sector at 27.9% of ransomware victims.

Germany reported 370 ransomware incidents (17.9%), the United Kingdom reported 347 (16.8%), France repored 255 (12.3%), Italy reported 240 (11.6%), and Spain reported 203 (9.8%) among ransomware incidents across Europe.

Direct ransomware attacks on financial institutions spiked 76% year-over-year in Q1 2026.

Across all financial services vendors, 50.2% carry high-severity CVEs.

Over 48,000 CVEs were published globally in 2025, an 18% year-on-year increase.

Attackers exploited vulnerabilities an average of seven days before public disclosure in 2025.

More than 48,000 CVEs were published in 2025, an 18% increase year-over-year.

2,130 AI-related vulnerabilities were reported in 2025, a more than 200% increase since 2023.

433 million people are publicly disclosed as impacted by third-party breaches.

Every breached vendor now compromises an average of 5.28 downstream companies.

An estimated 26,000 shadow victims remain impacted by vendor breach cascades but are never officially named.

Among companies with less than $20 million, manufacturing is the second targeted industry at 17%.

Manufacturing remains ransomware's number one target. It has held the number one position for the fourth year in a row.

75% of manufacturing companies have critical vulnerabilities with a CVSS score of 8 or higher.

Black Kite researchers found that 31 out of 140 third-party vendors have at least one critical vulnerability with a CVSS at or above 8. 15 vendors show an extremely high risk with CVSS scores above 9.

90 third-party vendors are flagged with high-risk threat categories. Among these, 35 vendors are marked with Known Exploited Vulnerabilities (KEV) tags.

There were 191 disclosed ransomware victims in the financial sector in 2023.

Ransom payment values declined by 35%.

There are now 96 active ransomware groups.

Publicly disclosed ransomware victims climbed to 6,046. This represents a 24% increase year over year for publicly disclosed victims. The victim count has also more than doubled since 2023.

Over 4,400 of the disclosed CVEs in 2024 were classified as critical (CVSS 9.0+).

Over 20,000 of the disclosed CVEs in 2024 had a CVSS score of 7.0 or higher.

There was a 38% year-over-year increase in published CVEs.

61.6% of healthcare ransomware victims reported attacks to the HHS in 2024.

High-volume groups INC Ransom (21.7%) and BianLian (15%)show a strong healthcare focus.

There was 211 US healthcare ransomware victims in 2023 and 268 in 2024, a 27% increase.

Stealer log exposure increased 175% in a before-and-after security posture comparison.

30.8% of ransomware victims carried KEV exposure.

18.5% of ransomware victims carried FocusTag signals.

Ransomware activity accelerated 60% in the second half of the reporting period and closed with 861 victims in March 2026, the highest monthly total in four years.

Qilin claimed more than 1,300 victims, nearly twice as many as its nearest rival.

43.5% of victims still carried critical patch vulnerabilities in the latest assessment.

Within professional, scientific, and technical services, IT service providers were the single most-targeted subindustry by ransomware.

Ransomware attacks rose 55.1% year-over-year in the first four months of 2026 and reached an average of 171 incidents per month.

The Qilin ransomware group was linked to ransomware incidents in 26 of the 31 countries analysed.

More than half of SafePay's ransomware activity in Europe targeted German organisations.

64 European organisations were drawn into a ransomware or data extortion incident through a third party.

Professional, scientific, and technical services accounted for 17.8% of ransomware victims.

53% of the organisations drawn into third-party ransomware or data extortion incidents traced to a single event: the August 2025 compromise of Miljödata.

In September 2025, Qilin's compromise of a single South Korean MSP affected 32 financial institutions and resulted in over 2 terabytes of stolen data.

Qilin was responsible for 59 finance-sector incidents in the past year.

From 2024 to 2025, the number of critical vulnerabilities carried across vendors serving the financial sector increased 387%.

The number of distinct threat groups targeting finance increased from 37 in 2023 to 45 in 2024 and to 48 in 2025.

Reported ransomware incidents targeting finance increased 30% from 2024 to 2025.

Among the 140 vendors whose client base is meaningfully concentrated in finance, critical vulnerabilities increased 181%.

Critical-level patch management failures were present in 78% of the 140 vendors whose client base is meaningfully concentrated in finance.