Manufacturing Sector Remains Top Ransomware Target for Fifth

Manufacturing organizations represented 22% of all ransomware victims from April 2025 to March 2026, according to a new study from threat intelligence firm Black Kite. This marks the fifth consecutive year the industry has been the most targeted sector for ransomware attacks.

Reported ransomware incidents in manufacturing surged by approximately 40% year-over-year in the period from January 1 to July 29, 2026. The count rose from 847 to 1183, continuing an annual upward trend in disclosed attacks observed by researchers since 2022.

Why Manufacturing is a Prime Target

Analysts cite several reasons for the sector's persistent targeting. A successful ransomware attack can cause extensive operational downtime, leading to major financial losses. This pressure makes victim organizations more likely to pay a ransom to restore operations quickly. The financial impact was exemplified by a 2025 attack on UK car manufacturer Jaguar Land Rover, which Black Kite estimates cost the UK economy £1.9bn.

Another key factor is the growing convergence of information technology (IT) and operational technology (OT) systems within manufacturing. This integration can create pathways for threat actors to compromise critical industrial control systems.

European Victim Count Spikes Dramatically

The Black Kite report details a seismic shift in victim geography. European manufacturing ransomware victims grew by 85.4% in the first seven months of 2026 compared to the same period in 2025, rising from 199 to 369.

In contrast, the US victim count remained relatively stable, decreasing slightly from 443 to 412 incidents. Consequently, the proportion of US manufacturing victims fell from 52.3% to 34.8% of the global total.

Germany, whose manufacturing sector comprises 20% of its economy, recorded the highest number of victims in Europe. Its count rose from 42 to 77 year-over-year. Other European countries with high victim volumes included Italy (57), the UK (43), and France (40).

Key Threat Groups Behind the Attacks

Researchers attributed part of the enormous growth in European victims to the SafePay ransomware actor's focused campaigns against German manufacturing targets. The report also highlighted the growing activity of The Gentlemen ransomware group, which has heavily targeted the sector.

Victims in manufacturing made up 23% of The Gentlemen's leak site listings. Despite only first being observed in September 2025, the group claimed the second-highest number of ransomware victims in the first seven months of 2026.

The top ransomware groups by victim count for that period were:

Black Kite's analysis shows the sustained and evolving cyber threat facing global manufacturing, with attackers increasingly looking beyond North America for high-impact opportunities.