Dragos

Ransomware remained the most persistent and disruptive cyber threat to industrial organizations in Q2 2026

Manufacturing was the most affected sector by ransomware incidents affecting industrial organizations worldwide, with 747 incidents (65%) across all subsectors in Q2 2026.

Transportation and logistics was the third-most-impacted sector by ransomware incidents affecting industrial organizations worldwide, with 95 incidents in Q2 2026.

25% of ICS-CERT and NVD vulnerabilities have incorrect CVSS scores.

The average dwell time for ransomware in OT environments is 42 days.

Ransomware attacks against industrial organizations increased 64% year-over-year.

Worst-case scenarios for global financial risk from OT cyber incidents are estimated at as much as $329.5 billion.

In a severe, but plausible scenario (a 1-in-250-year tail event), global OT cyber losses could reach $329.5 billion, with $172.4 billion specifically from OT-related business interruption.

The three OT cybersecurity controls most correlated with risk reduction are: Incident Response Planning (up to 18.5% average risk reduction), Defensible Architecture (up to 17.09%), ICS Network Visibility and Monitoring (up to 16.47%).

In the first half of 2024, ransomware groups attacked an average of 34 industrial organizations per week. That number more than doubled during the second half of the year.

Manufacturing remains the most affected sector by ransomware, accounting for more than 50% of observed ransomware victims.

70% of the vulnerabilities researched were deep within the ICS network and 39% could cause both a loss of view and a loss of control.

ICS-related organizations (engineering firms, system integrators, and equipment manufacturers) accounted for the second-most-impacted sector by ransomware incidents ffectign industrial organizations worldwide, with 117 incidents in Q2 2026.

North America and Europe remained the regions most affected by ransomware incidents targeting industrial organizations worldwide in Q2 2026.

The U.S. was the country most impacted by ransomware incidents affecting industrial organizations worldwide, with 431 incidents in Q2 2026, accounting for 38% of all incidents in Q2 2026.

Germany saw the largest quarterly increase in ransomware incidents affecting industrial organizations worldwide, rising from 37 incidents in Q1 2026 to 68 in Q2 2026.

In the second quarter (Q2) of 2026, analysis of publicly disclosed victim data and ransomware groups’ postings on Data Leak Sites (DLS) identified 1,140 ransomware incidents affecting industrial organizations worldwide, a 12% increase over the 1,020 incidents recorded in Q1.

Qilin, Akira, and The Gentlemen were the most active ransomware groups targeting industrial organizations worldwide in Q2 2026, accounting for the largest numbers of victims.

Organizations with comprehensive OT visibility detect and contain OT ransomware incidents in an average of 5 days, compared to the industry-wide average of 42 days.

KAMACITE conducted sustained reconnaissance of U.S. industrial devices from March through July 2025.

Manufacturing accounts for more than two-thirds of all ransomware victims.

26% percent of advisories in 2025 contained no patch or mitigation from vendors.

The number of ransomware groups targeting industrial organizations increased 49% year-over-year to 119 groups, collectively impacting 3,300 organizations globally.

In June 2025, BAUXITE deployed two custom wiper malware variants against Israeli targets.

Indirect losses impact up to 70% of OT-related breaches.

75% of the ransomware cases Dragos observed involved disruption to operations to some degree.

25% of the ransomware cases Dragos observed involved full shutdown of an OT site.

Ransomware activity surged at an increase of more than 87% over last year.