Ransomware Attacks Surge 85 Percent Across European Manufacturing

The global ransomware landscape is undergoing a dramatic geographic transformation. According to Black Kite’s 2026 Manufacturing & Distribution Ransomware Report, European manufacturing victims surged by 85.4 percent in the first seven months of 2026, fundamentally reshaping a threat environment that was once dominated by North American targets. The United States share of global manufacturing ransomware victims fell from 52.3 percent to 34.8 percent, not because American attacks declined significantly, but because the volume of attacks elsewhere grew at an unprecedented pace.

The Geographic Pivot

For years, the United States held the unenviable position of being the primary target for ransomware groups targeting manufacturing. That dominance is now eroding. Black Kite’s research, covering the period from January 2023 through July 2026, reveals that the U.S. victim count actually declined only modestly, from 443 to 412. The real story is the explosive growth in attacks against European manufacturers, particularly in Germany, where manufacturing accounts for nearly 20 percent of the national economy.

German manufacturing ransomware victims increased by more than 83 percent in the first seven months of 2026 compared to the same period in 2025. This surge aligns with broader European trends, where the number of distinct ransomware groups active against manufacturers grew from 55 in 2023 to 91 in just the first seven months of 2026. The geographic expansion means that European manufacturers, many of whom historically considered themselves secondary targets, now face the same concentrated threat pressure as their American counterparts.

A Rebuilt Threat Actor Ecosystem

Perhaps the most striking finding from the Black Kite report is that 49.7 percent of 2026 manufacturing ransomware incidents came from groups that were entirely absent from the threat landscape in 2023 and 2024. The attacker ecosystem has effectively rebuilt itself in under two years, with the traditional heavy hitters being replaced by a new hierarchy of groups including Qilin, The Gentlemen, Akira, DragonForce, and INC Ransom.

Black Kite counted 61 new groups entering the ransomware ecosystem in a single year, averaging more than one new group per week. Crucially, these new groups added volume on top of the existing incumbents rather than replacing them. Manufacturing, as the largest victim pool, absorbed the largest share of this new attack capacity.

The Gentlemen: A Case Study in Rapid Scaling

Among the new arrivals, The Gentlemen ransomware group exemplifies how quickly new entrants can establish dominance. First appearing in Black Kite’s dataset in September 2025, the group claimed 142 manufacturing victims by mid-2026. Manufacturing now accounts for 23.1 percent of the group’s overall activity, representing one of the highest concentrations among major ransomware groups. A single new entrant accounted for 12 percent of all manufacturing ransomware incidents in 2026.

The Mid-Market Under Siege

The data reveals a clear shift in victim demographics. The median ransomware victim in the manufacturing sector generates $42.9 million in annual revenue, and 70.2 percent of manufacturing victims fall within the $10 million to $100 million revenue band. Between 2023 and the first half of 2026, 73 percent of ransomware attacks in North America and Europe targeted mid-market companies.

This represents a significant departure from the popular narrative that ransomware groups primarily target large enterprises. Mid-sized manufacturers often occupy critical positions within the supply chains of larger companies, meaning that attacks on the mid-market can cascade outward, disrupting operations well beyond the initial victim. The $50 million to $100 million revenue band saw the biggest jump of any segment, growing from 25.1 percent to 29.3 percent of victims with known revenue.

Why Manufacturing Remains the Top Target

Manufacturing has held the top spot among ransomware targets for four consecutive years, accounting for 22 percent of all 7,551 publicly disclosed ransomware victims in 2026. Ferhat Dikbiyik, Chief Research and Intelligence Officer at Black Kite, explains the attraction: “What makes manufacturing and distribution so attractive to ransomware operators is the immediate operational impact. One successful attack can stop production lines and disrupt delivery commitments, and every hour of downtime strengthens the attacker’s negotiating position.”

The first seven months of 2026 alone produced 1,183 manufacturing ransomware victims, already surpassing the full-year totals for both 2023 and 2024. Ransomware attacks on manufacturers have more than doubled since 2023, and the year-over-year growth rate for the first half of 2026 was nearly 40 percent.

External Exposure as a Predictive Indicator

Black Kite’s research introduces the concept of the Ransomware Susceptibility Index (RSI), which measures externally observable cybersecurity exposures using non-intrusive, attacker-perspective methods. The findings are sobering: nearly three-quarters of manufacturing victims (74.4 percent) had an RSI above 0.4, placing them in the critical range. More than one-third (35.1 percent) had an RSI of 0.6 or higher, and the average victim scored 0.552.

Attackers conduct reconnaissance based on externally visible signals, including:

• Unpatched systems and exploitable services exposed to the internet
• Leaked credentials circulating on dark web marketplaces
• Misconfigured defenses that fail to block known attack vectors
• Open Remote Desktop Protocol connections and other common entry points

These same signals are available to defenders through third-party risk assessment tools, yet the data suggests that most victims were not actively monitoring their external attack surface at the time of compromise.

The Supply Chain Cascade Effect

Manufacturing does not sit at the edge of the supply chain problem. It sits in the middle of it. When a manufacturer appears on a ransomware leak site, the impact extends to every company that depends on its output. Black Kite identified the most victimized subsectors as those within automotive and aerospace supply chains, where the largest companies sit at the center of the deepest supplier networks.

The SafePay ransomware group illustrates this dynamic in the European context. SafePay accounted for 21.9 percent of German manufacturing ransomware victims in 2025 and remains among the country’s most active ransomware groups in 2026. Its concentration on German targets reflects a broader trend of groups specializing in specific geographic markets rather than casting a global net.

Recommendations for Manufacturers

The report’s findings point to several actionable steps for manufacturing organizations seeking to reduce their ransomware susceptibility:

• Monitor external attack surface continuously rather than relying on periodic assessments. Attackers scan for weaknesses in real time, and static point-in-time evaluations quickly become outdated.
• Prioritize patch management for internet-facing systems. The collapse of patch windows to hours, accelerated by AI-driven vulnerability discovery, means that traditional monthly patching cycles are no longer sufficient.
• Assess third-party risk across the supply chain. Mid-market manufacturers are often targeted precisely because they provide access to larger enterprise networks upstream.
• Implement robust backup and recovery strategies. With ransomware groups increasingly weaponizing backup destruction, traditional backup approaches may not survive a determined attack.
• Prepare for hybrid AI-assisted attacks. Bitdefender’s November 2026 analysis of the 3AM ransomware group’s attack on a UK school estate demonstrated that human-AI hybrid operations are now a documented reality, with attackers combining human decision-making with AI-driven mechanical execution.

Looking Ahead

The ransomware ecosystem has entered a phase of unprecedented churn. With 61 new groups emerging in a single year, the traditional approach of tracking known threat actors is no longer sufficient. The geographic shift toward Europe, combined with the downward shift in victim revenue profiles, means that a broader range of organizations than ever before must treat ransomware as a clear and present danger rather than a hypothetical risk.

As Black Kite’s research demonstrates, the organizations most likely to become victims are those that display measurable signs of susceptibility visible from the outside. Closing those external exposures before attackers exploit them represents the most effective defensive strategy available in a landscape where the attacker ecosystem rebuilds itself faster than defenders can map it.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous