Manufacturing Accounts for 22% of all Ransomware Victims
Black Kite finds manufacturing was the most ransomware-targeted sector for a fifth year, with incidents up roughly 40% and European victims growing 85.4%.
A Black Kite study reports manufacturing accounted for 22% of all ransomware victims from April 2025 to March 2026, the most-targeted sector for the fifth consecutive year. Disclosed manufacturing incidents rose from 847 to 1,183 between January 1 and July 29, 2026, with European victims up 85.4% (199 to 369) and Germany leading at 77. Researchers attribute European growth partly to SafePay's focus on German manufacturing, while Qilin (178 victims) and The Gentlemen (142) were the most active groups in early 2026. The 2025 Jaguar Land Rover attack, estimated to have cost the UK economy £1.9bn, illustrates the sector's financial exposure from downtime and IT-OT convergence.
- Manufacturing: 22% of all ransomware victims April 2025 to March 2026
- Incidents surged ~40% year-over-year to 1,183 between January and July 2026
- European victims grew 85.4%, with Germany at 77 and Italy at 57
- SafePay targets German manufacturing; The Gentlemen at 23% of its leak-site victims
- IT-OT convergence and downtime costs increase likelihood of paying extortion
- Vendors
- Black Kite
- Threat actors
- SafePayThe GentlemenQilin
- Victims
- Jaguar Land Rover
From the original article
2 min read at infosecurity-magazine.com
Black Kite has found that manufacturing remained the most targeted sector for ransomware attacks, and saw a big jump in incidents in H1 2026
By James Coker · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.