Manufacturing Ransomware Attacks Surge 40% in 2026, Targeting Mid-Market and European Firms
Event summary
- Ransomware attacks on manufacturers surged nearly 40% year over year in the first half of 2026, with 1,183 victims in the first seven months alone.
- Manufacturing accounted for 22% of all publicly disclosed ransomware victims across industries, marking the fourth consecutive year as the top target.
- The U.S. share of global manufacturing ransomware victims fell from 52.3% to 34.8%, driven by an 85.4% increase in European victims, particularly in Germany.
- 73% of ransomware attacks in North America and Europe from 2023 to mid-2026 targeted mid-market companies, with a median revenue of $42.9 million.
- The Gentlemen, a new ransomware group, claimed 142 manufacturing victims by mid-2026, accounting for 12% of the year's incidents.
The big picture
The manufacturing sector remains the primary target for ransomware attacks, with a notable shift towards mid-market companies and a significant increase in European victims. This trend underscores the critical need for continuous monitoring and assessment of external attack surfaces across the supply chain. The rise of new threat groups and the geographic expansion of attacks highlight the evolving nature of cyber threats and the importance of proactive cyber risk management strategies.
What we're watching
- Geographic Shift
- Whether the surge in European manufacturing ransomware victims, particularly in Germany, will continue to outpace U.S. incidents.
- Mid-Market Vulnerability
- How the concentration of attacks on mid-market manufacturers will impact larger enterprises dependent on these suppliers.
- Emerging Threat Groups
- The pace at which new ransomware groups like The Gentlemen will expand their operations in the manufacturing sector.