Report by Dragos
Industrial Ransomware Analysis for Q2 2026
Key Findings
Ransomware remained the most persistent and disruptive cyber threat to industrial organizations in Q2 2026
Manufacturing was the most affected sector by ransomware incidents affecting industrial organizations worldwide, with 747 incidents (65%) across all subsectors in Q2 2026.
ICS-related organizations (engineering firms, system integrators, and equipment manufacturers) accounted for the second-most-impacted sector by ransomware incidents ffectign industrial organizations worldwide, with 117 incidents in Q2 2026.
Transportation and logistics was the third-most-impacted sector by ransomware incidents affecting industrial organizations worldwide, with 95 incidents in Q2 2026.
North America and Europe remained the regions most affected by ransomware incidents targeting industrial organizations worldwide in Q2 2026.
The U.S. was the country most impacted by ransomware incidents affecting industrial organizations worldwide, with 431 incidents in Q2 2026, accounting for 38% of all incidents in Q2 2026.
Germany saw the largest quarterly increase in ransomware incidents affecting industrial organizations worldwide, rising from 37 incidents in Q1 2026 to 68 in Q2 2026.
In the second quarter (Q2) of 2026, analysis of publicly disclosed victim data and ransomware groups’ postings on Data Leak Sites (DLS) identified 1,140 ransomware incidents affecting industrial organizations worldwide, a 12% increase over the 1,020 incidents recorded in Q1.
Qilin, Akira, and The Gentlemen were the most active ransomware groups targeting industrial organizations worldwide in Q2 2026, accounting for the largest numbers of victims.