Ransomware Attacks on Manufacturers Surge 40% Year Over Year

Black Kite, a leader in third-party cyber risk management, has released its 2026 Manufacturing & Distribution Ransomware Report, which highlights the continued rise in ransomware attacks on manufacturers. According to the report, ransomware attacks on manufacturers surged by nearly 40% year over year in the first half of 2026, marking a significant increase from the previous year.

Ferhat Dikbiyik, Chief Research & Intelligence Officer (CRIO) at Black Kite, emphasized the immediate operational impact of successful ransomware attacks.

The research indicates that manufacturing remains the primary target for ransomware operators. In the first seven months of 2026, 1,183 manufacturing victims were recorded, a number that has surpassed the total for all of 2024. The report also notes that ransomware attacks on manufacturers have more than doubled since 2023, with a 39.7% year-over-year increase in the first half of 2026 alone.

The geographic footprint of manufacturing ransomware is expanding, particularly in Europe. Victim counts across Europe increased by 85.4%, while the U.S. share of global manufacturing ransomware victims fell from 52.3% to 34.8%. Germany, which accounts for nearly 20% of the country's economy, saw a significant rise in manufacturing ransomware victims. The number of victims in the sector increased by more than 83% in the first seven months of 2026 compared to the same period in 2025.

SafePay, a group previously identified by Black Kite's European ransomware research, continues to target German manufacturers. In 2025, SafePay accounted for 21.9% of German manufacturing ransomware victims and remains among the country's most active ransomware groups in 2026.

The report also highlights that the primary target for ransomware is the mid-market, not the enterprise as widely assumed. The median ransomware victim generates $42.9 million in annual revenue, and from 2023 through the first half of 2026, 73% of ransomware attacks in North America and Europe hit mid-market companies. This concentration has broader implications, as mid-sized manufacturers often sit within the supplier networks of larger enterprises, making them a critical part of the attack surface.

One notable group contributing to the pressure on manufacturers is The Gentlemen, a new threat actor that first appeared in Black Kite's dataset in September 2025. By mid-2026, The Gentlemen had claimed 142 manufacturing victims, accounting for 23.1% of the group's activity, one of the highest concentrations among major ransomware groups.

The report's findings reveal that many victims displayed measurable signs of ransomware susceptibility at the time of disclosure. Nearly three-quarters (74.4%) of victims had a risk score index (RSI) above 0.4, placing them in the critical range, while more than one-third (35.1%) had an RSI of 0.6 or higher. The average victim scored 0.552, indicating a significant risk level.

For manufacturers and distributors, resilience depends on continuously measuring these external signals across their own organization and third-party ecosystems. The report emphasizes the importance of acting on these signals before a breach occurs to mitigate the risk of ransomware attacks.

The full report, which provides a blueprint for ranking suppliers by observable ransomware susceptibility, can be accessed at https://blackkite.com/reports/2026-manufacturing-distribution.