Report by Black Kite
2026 Manufacturing & Distribution Ransomware Report
Key Findings
Ransomware attacks on manufacturers have more than doubled since 2023.
The average manufacturing or distribution ransomware victim scores 0.552 on the RSI.
In the first half of 2026, ransomware attacks on manufacturers increased nearly 40% year over year.
Manufacturing accounted for 22% of all publicly disclosed ransomware victims.
Same-period manufacturing ransomware volume is up 39.7% year over year.
SafePay accounted for 21.9% of German manufacturing ransomware victims in 2025.
The first seven months of 2026 produced more manufacturing ransomware victims than all of 2024.
From 2023 through the first half of 2026, 73% of ransomware attacks in North America and Europe hit mid-market companies.
The U.S. manufacturing ransomware victim count changed from 443 to 412.
The U.S. share of global manufacturing ransomware victims fell from 52.3% to 34.8%.
Ransomware victims in Germany's manufacturing sector increased by more than 83% in the first seven months of 2026 compared with the same period in 2025.
The Gentlemen have claimed 142 manufacturing victims by mid-2026.
Manufacturing accounted for 23.1% of The Gentlemen's activity.
There were 1,183 manufacturing victims in the first seven months of 2026.
49.7% of 2026 manufacturing incidents came from groups that were absent in 2023 and 2024.
The Gentlemen accounted for 12% of 2026 manufacturing incidents.
70.2% of manufacturing victims sit in the $10M to $100M revenue band.
The median ransomware victim generates $42.9 million in annual revenue.
74.4% of manufacturing and distribution ransomware victims have an RSI above 0.4.
35.1% of manufacturing and distribution ransomware victims have an RSI of 0.6 or higher.
Manufacturing ransomware vctim counts across Europe increased 85.4%.