Manufacturing Remains Ransomware's Top Target as Attacks Surge Worldwide

Manufacturing has once again topped the list of industries hit hardest by ransomware, according to a new study from Black Kite. The sector made up 22% of all ransomware victims between April 2025 and March 2026, marking the fifth consecutive year it has been the most targeted industry. Incidents in manufacturing jumped roughly 40% year-over-year between January and July 2026, rising from 847 to 1,183 cases.

Researchers point to two key reasons manufacturers are such attractive targets. First, ransomware attacks can cause major production downtime, creating financial pressure that makes victims more likely to pay a ransom to resume operations. The 2025 attack on Jaguar Land Rover, which is estimated to have cost the UK economy £1.9bn, illustrates how severe these losses can be. Second, growing connections between IT and operational technology (OT) systems in factories are making it easier for attackers to break into industrial equipment.

The report also found a sharp rise in European manufacturing victims, up 85.4% in the first seven months of 2026 compared to the same period last year, while the number of US victims held steady. Germany recorded the highest number of European victims, followed by Italy, the UK and France. Researchers linked part of this growth to the SafePay ransomware group's focus on German manufacturers, alongside rising activity from another group known as The Gentlemen.