Manufacturing organizations made up over a fifth (22%) of all ransomware victims in the period from April 2025 to March 2026, according to new Black Kite study.
This made the industry the most targeted by ransomware attacks for the fifth consecutive year, the analysis found.
The volume of ransomware incidents in the manufacturing sector also surged by around 40% year-over-year in the period from January 1 to July 29, 2026 – from 847 to 1183.
This growth continued a trend observed by the researchers of disclosed ransomware incidents in manufacturing rising every year since 2022.
Manufacturing is viewed as a high-value target for ransomware actors for a number of reasons. One factor is that a successful attack can result in significant downtime for victim organizations, which in turn leads to substantial financial losses, potentially making them more likely to agree to pay an extortion demand to resume operations.
The financial impact of such incidents was highlighted in the attack on UK car manufacturing giant Jaguar Land Rover (JLR) in 2025, which is estimated to have cost the UK economy £1.9bn ($2.5bn).
Another factor is growing IT-OT convergence in the sector, making it easier for threat actors to compromise industrial systems.
Read now: Körber’s CISO on Securing Manufacturing’s Expanding Cyber Attack Surface
Seismic Growth in European-Based Manufacturing Victims
The Black Kite report, published on September 17, also reported an 85.4% growth in European manufacturing ransomware victims in the first seven months of 2026 compared to the same period in 2025, from 199 to 369.
Meanwhile, the US victim count remained stable, from 443 incidents to 412. This meant the proportion of US manufacturing victims fell from 52.3% to 34.8%.
Germany, which has a large manufacturing hub comprising 20% of its economy, represented the biggest number of ransomware victims in the sector in Europe, rising from 42 to 77 year-over-year in the first seven months of 2026.
Italy made up the second highest volume of victims, at 57, followed by the UK (43) and France (40).
One factor in the enormous growth in European victims was the SafePay ransomware actor’s focus on German manufacturing targets, according to the researchers.
The Black Kite researchers also highlighted the growing activity of The Gentlemen ransomware actor in targeting manufacturing, with victims in this sector making up 23% of the group’s leak site listings.
Despite only first being observed in September 2025, The Gentlemen claimed the second highest number of ransomware victims in the first seven months of 2026, at 142. This was behind Qilin, at 178.
Read now: Three-quarters of Ransomware Attacks Target Mid-Market Firms
