Manufacturing Ransomware Victims Surge 40% as Europe Bears Brunt

Manufacturing organisations accounted for 22% of all ransomware victims between April 2025 and March 2026, according to a Black Kite study, making the sector the most targeted for the fifth consecutive year. Disclosed incidents in manufacturing rose by about 40% year on year, from 847 to 1,183, between 1 January and 29 July 2026. Researchers said the increase continues a yearly rise in reported incidents since 2022.

Manufacturing is considered an attractive target because disruption can cause extensive downtime and financial losses, potentially increasing pressure to pay extortion demands. Growing convergence between information technology and operational technology may also give attackers more opportunities to compromise industrial systems.

The report, published on 17 September 2026, found an 85.4% increase in European manufacturing ransomware victims during the first seven months of 2026, rising from 199 to 369. US incidents fell from 443 to 412, reducing the US share from 52.3% to 34.8%. Germany recorded the most European victims, increasing from 42 to 77, followed by Italy with 57, the UK with 43 and France with 40. Black Kite attributed part of Europe’s growth to the SafePay ransomware group’s focus on German manufacturers.

The researchers also highlighted The Gentlemen, whose victims in the sector represented 23% of its leak-site listings. The group, first observed in September 2025, claimed 142 victims in the first seven months of 2026, behind Qilin’s 178.