A report has linked 148 ransomware attacks to Italian organizations in the first half of 2026, with manufacturing being the most affected sector. Approximately 25 claims were reported per month, leading to the exfiltration of over 13,400 GB of data, though this figure covered only 64 cases. Northwest Italy, particularly Lombardy, saw the highest attack rates, with LockBit5 and Qilin leading as the most active ransomware groups, each responsible for 21 attacks.
The report highlighted that many attackers used common methods such as reused credentials and exposed systems. Manufacturing accounted for nearly 40% of all attacks, showing the sector's vulnerability due to its operational dependencies.