MILAN, September 23 — Ransomware crews have found their favourite factory floor, and they are not leaving. New data from Black Kite’s 2026 Manufacturing & Distribution Ransomware Report, released in a Thursday media statement, shows attacks against manufacturers surged to 1,183 publicly disclosed victims between Jan. 1 and July 29, 2026 — a 39.7% jump over the 847 victims recorded in the same window last year. That seven-month tally already blows past the full-year 2024 figure of 1,071 victims.
The trend underneath is relentless: manufacturing ransomware activity has climbed every single year since 2022, when Black Kite tracked 540 incidents, then 926 in 2023, 1,071 in 2024 and 1,600 in 2025.
The mid-market is the new front line
The shift is in who is getting hit. Companies generating $10 million to $100 million in annual revenue made up 70.2% of manufacturing victims, with the median victim generating $42.9 million. Smaller balance sheets, thinner security teams — and production lines that cannot simply pause.
Geography is moving too. European manufacturing victims rose 85.4%, cutting the U.S. share of global manufacturing ransomware victims from 52.3% to 34.8%.
Germany alone recorded an increase of more than 83% in manufacturing victims during the first seven months of 2026 compared with the same period in 2025, in an economy where manufacturing comprises 19.9%. American victim counts barely budged, slipping from 443 to 412 cases. In the first half of 2026 alone, Black Kite logged 1,020 manufacturing incidents — the highest half-year total in its dataset and up 34.2% from 760 in the first half of 2025.
Across all industries, manufacturing accounted for 1,660 of the 7,551 publicly disclosed ransomware victims, or 22% of all disclosures, marking the fifth consecutive year it has held the top spot.
New crews, familiar playbook
Nearly half of the 2026 incidents came from threat groups absent in 2023 and 2024. A single new entrant, The Gentlemen, independently accounts for 12.0% of the year’s incidents — a striking concentration for a newcomer. By subsector, machinery manufacturing leads the full period with 701 victims (15.2% of subsector-classified victims), followed by fabricated metal products with 515 (11.2%).
Ferhat Dikbiyik, chief research and intelligence officer at Black Kite, said in the Thursday media statement that manufacturing and distribution are attractive because of the immediate operational impact. “One successful attack can stop production lines and disrupt delivery commitments, and every hour of downtime strengthens the attacker’s negotiating position,” he said.
“But attackers don’t operate blindly. Their reconnaissance relies on externally visible signals, from unpatched systems and exploitable services to leaked credentials and misconfigured defenses. Black Kite analyzes that same external attack surface, giving organizations a view of what adversaries can already see and where they may be most vulnerable.” The 44-page report lands as industrial operators push more sensors, controllers and shop-floor systems online — expanding exactly the externally visible surface Dikbiyik describes.
Watch this space: with European victims climbing fast and new crews settling in, the question for mid-market manufacturers is no longer whether they are a target, but how much of their attack surface is already mapped.
