Ransomware Attacks on Manufacturers Rise 39.7% in Seven Months

Black Kite counted 1,183 publicly disclosed ransomware victims in manufacturing from January 1 through July 29, 2026, a 39.7 percent increase over the same dates in 2025. Its first-half count was 1,020, up 34.2 percent year over year. Those figures are not interchangeable: the 40 percent headline reported by SecurityWeek uses the first seven months, while the stricter first-half comparison is 34.2 percent.

The Black Kite report tracks publicly disclosed ransomware and data-extortion incidents found through leak sites, extortion posts, and other dark-web sources, then validates them against open-source information and its own telemetry. It is a useful trend dataset, not a count of every attack: incidents that were never disclosed or settled privately are not included. That limitation matters when comparing the report’s totals with government incident reports or victim notifications.

The report’s actor mix also changed. Black Kite attributes 49.7 percent of its 2026 manufacturing cases through July to groups that did not appear in its 2023-24 dataset. The Gentlemen accounted for 12 percent of the 2026 cases it counted. This churn makes a single-group defense strategy brittle; manufacturers need controls that still help when the brand and intrusion tooling change.

The sector’s operational exposure is not just the factory network. A shutdown can delay parts, logistics, and customer deliveries beyond the compromised company. That makes recovery priorities and supplier communication part of incident planning. Manufacturers should identify which production processes can safely run in isolation, verify offline restoration paths, and agree in advance how to notify dependent suppliers and customers if systems are taken down.

Analysis: the dataset establishes increased publicly disclosed victim volume, but it does not by itself prove that attackers specifically chose victims to maximize supply-chain disruption. That motive should not be inferred from the percentage increase alone.

Related: Veradigm patient breach after ransomware activity and Manchester Airports extortion claim.