Black Kite today released Manufacturing & Distribution Ransomware Report 2026, Still the #1 Target, but the Victim Profile Moved Downmarket and Overseas (https://blackkite.com/reports/2026-manufacturing-distribution). Examining the pressure across the full supply chain – from manufacturers to the companies that move their products – the report provides a blueprint for ranking suppliers by observable ransomware susceptibility, rather than by revenue, tier, or the date of their last questionnaire.
Ransomware Attacks Continue to Accelerate
Manufacturing’s position at the top is consistent across Black Kite’s broader ransomware research. Black Kite’s 2026 Ransomware Report identified 7,551 publicly disclosed ransomware victims across all industries, with manufacturing ranking first for the fourth consecutive year accounting for 22% of all disclosures.
While ransomware activity is rising across industries, manufacturing stands apart for the consistency and pace of that growth. Ransomware attacks on manufacturers have more than doubled since 2023, and in the first half of 2026 alone, attacks increased nearly 40% year over year.
Manufacturing Ransomware is Going Global
The geographic footprint of manufacturing ransomware is expanding, driven by a sharp rise in European victims. Victim counts across Europe increased 85.4%, while the U.S. share of global manufacturing ransomware victims fell from 52.3% to 34.8%.
Germany saw particularly significant growth. Manufacturing accounts for nearly 20% of the country’s economy, and ransomware victims in the sector increased more than 83% in the first seven months of 2026 compared with the same period in 2025.
One group contributing to that pressure is SafePay. Black Kite’s European ransomware research previously identified the group’s concentration on German targets. SafePay accounted for 21.9% of German manufacturing ransomware victims in 2025 and remains among the country’s most active ransomware groups in 2026.
The Victim Profile: Mid-Market Bears the Brunt
Ransomware’s primary target is the mid-market, not the enterprise as widely assumed. The median ransomware victim generates $42.9 million in annual revenue, and from 2023 through the first half of 2026, 73% of ransomware attacks in North America and Europe hit mid-market companies.
For manufacturing, that concentration carries broader implications. Mid-sized manufacturers often sit within the supplier networks of larger enterprises, meaning attacks on the mid-market can create risk well beyond the initial victim. When suppliers are the primary target, a manufacturer’s vendor ecosystem becomes part of its attack surface.
Threat Actor Spotlight: The Gentlemen
The threat actor ecosystem has been rebuilt, with the hierarchy of players being replaced by Qilin, The Gentleman, Akira, DragonForce, and INC Ransom. Among the new arrivals, The Gentlemen stands out for how quickly it found its footing in manufacturing.
First appearing in Black Kite’s dataset in September 2025, The Gentlemen had claimed 142 manufacturing victims by mid-2026. Manufacturing now accounts for 23.1% of the group’s activity, one of the highest concentrations among major ransomware groups.
Key findings from the report:
- 1,183 Manufacturing Victims in Seven Months, and the Climb Hasn’t Paused: The first seven months of 2026 produced more manufacturing victims than all of 2024, and same-period volume is up 39.7% year over year.
- 49.7% of 2026 Incidents Came From Groups Absent Two Years Ago: The attacker ecosystem rebuilt itself in two years. Nearly half of 2026 manufacturing incidents came from groups absent in 2023 and 2024, and a single new entrant, The Gentlemen, accounts for 12% of the year’s incidents on its own.
- 70.2% of Manufacturing Victims Sit in the $10M to $100M Revenue Band: The mid-market carries the volume. The median victim generates $42.9 million in revenue, while the largest manufacturers continue to be hit every year.
- 85.4% Growth in European Victims Cut the U.S. Share to 34.8%: The U.S. victim count barely moved (443 to 412), so the drop in the U.S. share from 52.3% to 34.8% came entirely from growth elsewhere, led by Germany, where manufacturing carries 19.9% of the economy
The report measured every exposure from the outside, using the same vantage point available to an attacker. The findings show that many victims displayed measurable signs of ransomware susceptibility at the time of disclosure. Nearly three-quarters (74.4%) had an RSI above 0.4, placing them in the critical range, while more than one-third (35.1%) had an RSI of 0.6 or higher. The average victim scored 0.552.
For manufacturers and distributors, resilience depends on continuously measuring these external signals across their own organizations and third-party ecosystems, and acting on them before a breach occurs.
To read the report, visit https://blackkite.com/reports/2026-manufacturing-distribution.
Related
This entry was posted on September 17, 2026 at 9:01 am and is filed under Commentary with tags Black Kite. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Black Kite’s Manufacturing & Distribution Ransomware Report 2026 Confirms Manufacturing Remains #1 Target
Black Kite today released Manufacturing & Distribution Ransomware Report 2026, Still the #1 Target, but the Victim Profile Moved Downmarket and Overseas (https://blackkite.com/reports/2026-manufacturing-distribution). Examining the pressure across the full supply chain – from manufacturers to the companies that move their products – the report provides a blueprint for ranking suppliers by observable ransomware susceptibility, rather than by revenue, tier, or the date of their last questionnaire.
Ransomware Attacks Continue to Accelerate
Manufacturing’s position at the top is consistent across Black Kite’s broader ransomware research. Black Kite’s 2026 Ransomware Report identified 7,551 publicly disclosed ransomware victims across all industries, with manufacturing ranking first for the fourth consecutive year accounting for 22% of all disclosures.
While ransomware activity is rising across industries, manufacturing stands apart for the consistency and pace of that growth. Ransomware attacks on manufacturers have more than doubled since 2023, and in the first half of 2026 alone, attacks increased nearly 40% year over year.
Manufacturing Ransomware is Going Global
The geographic footprint of manufacturing ransomware is expanding, driven by a sharp rise in European victims. Victim counts across Europe increased 85.4%, while the U.S. share of global manufacturing ransomware victims fell from 52.3% to 34.8%.
Germany saw particularly significant growth. Manufacturing accounts for nearly 20% of the country’s economy, and ransomware victims in the sector increased more than 83% in the first seven months of 2026 compared with the same period in 2025.
One group contributing to that pressure is SafePay. Black Kite’s European ransomware research previously identified the group’s concentration on German targets. SafePay accounted for 21.9% of German manufacturing ransomware victims in 2025 and remains among the country’s most active ransomware groups in 2026.
The Victim Profile: Mid-Market Bears the Brunt
Ransomware’s primary target is the mid-market, not the enterprise as widely assumed. The median ransomware victim generates $42.9 million in annual revenue, and from 2023 through the first half of 2026, 73% of ransomware attacks in North America and Europe hit mid-market companies.
For manufacturing, that concentration carries broader implications. Mid-sized manufacturers often sit within the supplier networks of larger enterprises, meaning attacks on the mid-market can create risk well beyond the initial victim. When suppliers are the primary target, a manufacturer’s vendor ecosystem becomes part of its attack surface.
Threat Actor Spotlight: The Gentlemen
The threat actor ecosystem has been rebuilt, with the hierarchy of players being replaced by Qilin, The Gentleman, Akira, DragonForce, and INC Ransom. Among the new arrivals, The Gentlemen stands out for how quickly it found its footing in manufacturing.
First appearing in Black Kite’s dataset in September 2025, The Gentlemen had claimed 142 manufacturing victims by mid-2026. Manufacturing now accounts for 23.1% of the group’s activity, one of the highest concentrations among major ransomware groups.
Key findings from the report:
The report measured every exposure from the outside, using the same vantage point available to an attacker. The findings show that many victims displayed measurable signs of ransomware susceptibility at the time of disclosure. Nearly three-quarters (74.4%) had an RSI above 0.4, placing them in the critical range, while more than one-third (35.1%) had an RSI of 0.6 or higher. The average victim scored 0.552.
For manufacturers and distributors, resilience depends on continuously measuring these external signals across their own organizations and third-party ecosystems, and acting on them before a breach occurs.
To read the report, visit https://blackkite.com/reports/2026-manufacturing-distribution.
Share this:
Like this:
Related
This entry was posted on September 17, 2026 at 9:01 am and is filed under Commentary with tags Black Kite. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.