New data from Black Kite’s 2026 Manufacturing & Distribution Ransomware Report identified that manufacturers continue to bear a disproportionate share of ransomware attacks, accounting for 22% of the 7,551 publicly disclosed ransomware victims across all industries. Ransomware attacks against manufacturers have more than doubled since 2023, with incidents increasing 39.7% year over year during the first seven months of 2026 to 1,183 victims, already surpassing the full-year total recorded in 2024.
The 44-page report also points to a shift in ransomware activity toward mid-market companies and manufacturers outside the U.S. Companies generating $10 million to $100 million in annual revenue represented 70.2% of manufacturing victims, while the median victim generated $42.9 million. European manufacturing victims increased by 85.4%, reducing the U.S. share of global manufacturing ransomware victims from 52.3% to 34.8%. Germany alone recorded an increase of more than 83% in manufacturing victims during the first seven months of 2026 compared with the same period in 2025.
“What makes manufacturing and distribution so attractive to ransomware operators is the immediate operational impact,” Ferhat Dikbiyik, chief research and intelligence officer (CRIO) at Black Kite, said in a Thursday media statement. “One successful attack can stop production lines and disrupt delivery commitments, and every hour of downtime strengthens the attacker’s negotiating position. But attackers don’t operate blindly. Their reconnaissance relies on externally visible signals, from unpatched systems and exploitable services to leaked credentials and misconfigured defenses. Black Kite analyzes that same external attack surface, giving organizations a view of what adversaries can already see and where they may be most vulnerable.”
Manufacturing ransomware attacks reached a critical inflection point in 2026, with 1,183 victims in the first seven months alone, exceeding the entire 2024 total and marking 39.7% year-over-year growth. Nearly half of these incidents came from threat groups absent in 2023 and 2024, demonstrating how the attacker ecosystem rebuilt itself over two years. A single new entrant, The Gentlemen, accounts for 12.0% of the year’s incidents independently.
Mid-market remains the primary target, with 70.2% of victims operating in the $10 million to $100 million revenue band, where the median victim generates $42.9 million. Manufacturing ransomware is globalizing: European victims grew substantially enough to reduce the US share from 52.3% to 34.8%, driven largely by growth in Germany, where manufacturing comprises 19.9% of the national economy, while the U.S. victim count remained stagnant, barely declining from 443 to 412 cases.
Black Kite’s 2026 Manufacturing & Distribution Ransomware Report found that ransomware activity against manufacturers has continued to rise, with 1,020 incidents recorded in the first half of 2026, the highest half-year total in the dataset. The first-half figure was up 34.2% from 760 incidents in the first half of 2025. The research also recorded 1,183 manufacturing incidents from Jan. 1 through July 29, compared with 847 during the same period in 2025, a 39.7% increase.
Manufacturing ransomware activity has increased every year since 2022, according to the report. Black Kite tracked 540 incidents in 2022, 926 in 2023, 1,071 in 2024, and 1,600 in 2025. Manufacturing accounted for 1,660 of the 7,551 publicly disclosed ransomware victims identified across all industries in Black Kite’s broader 2026 Ransomware Report, representing 22% of all disclosures and marking the fifth consecutive year that manufacturing held the top position.
Black Kite reported that the climb in manufacturing victims over the years is not the work of any single corner of the industry. “Machinery Manufacturing leads the full period with 701 victims (15.2% of subsector-classified victims), followed by Fabricated Metal Products with 515 (11.2%), Transportation Equipment with 425 (9.2%), Chemical Manufacturing with 423 (9.2%), Computer and Electronic Products with 407 (8.8%), and Food Manufacturing with 361 (7.8%). Together, the top five account for just over half of all classified victims.”
It added that at the finer level of detail, industrial machinery and general purpose machinery makers top the list, with pharmaceutical manufacturers close behind at 194 victims. These are the subsectors where a stopped line converts