Report by Black Kite
2026 European Cyber Risk Report: Ransomware Is Escalating and Your Third Parties Are the Entry Point
Key Findings
In the last 16 months, nearly 70% of Europe's ransomware activity was concentrated in Germany, the United Kingdom, France, Italy, and Spain.
Manufacturing was the most-affected sector at 27.9% of ransomware victims.
Germany reported 370 ransomware incidents (17.9%), the United Kingdom reported 347 (16.8%), France repored 255 (12.3%), Italy reported 240 (11.6%), and Spain reported 203 (9.8%) among ransomware incidents across Europe.
Within professional, scientific, and technical services, IT service providers were the single most-targeted subindustry by ransomware.
Ransomware attacks rose 55.1% year-over-year in the first four months of 2026 and reached an average of 171 incidents per month.
The Qilin ransomware group was linked to ransomware incidents in 26 of the 31 countries analysed.
More than half of SafePay's ransomware activity in Europe targeted German organisations.
64 European organisations were drawn into a ransomware or data extortion incident through a third party.
Professional, scientific, and technical services accounted for 17.8% of ransomware victims.
53% of the organisations drawn into third-party ransomware or data extortion incidents traced to a single event: the August 2025 compromise of Miljödata.