The manufacturing sector continues to hold the unenviable title of the most targeted industry, accounting for 22% of all global ransomware disclosures. According to the 2026 Manufacturing & Distribution Ransomware Report, the frequency of these attacks has more than doubled since 2023. Attackers are increasingly favoring mid-sized companies with annual revenues near $42.9 million, recognizing that operational downtime in a supplier’s facility can trigger cascading disruptions across entire supply chains.

Geographic patterns are shifting as well. While the United States remains a focal point, its share of global incidents dropped from 52.3% to 34.8% as European victims spiked by 85.4%. Germany has emerged as a central target, with ransomware activity in its manufacturing sector jumping 83% in early 2026. This escalation is driven by new threat actors like The Gentlemen, a group that appeared in late 2025 and already accounts for over 12% of manufacturing incidents this year.

Black Kite’s analysis highlights that nearly half of all 2026 attacks are being carried out by groups that were non-existent or inactive just two years ago. Most victims exhibited critical levels of vulnerability before their systems were compromised, with 74.4% of affected organizations showing high ransomware susceptibility scores. These findings suggest that adversaries are exploiting visible, unpatched external signals—such as leaked credentials and misconfigured defenses—long before a breach occurs.