Manufacturing ransomware victims rose 40% in seven months as European counts grew 85%
Black Kite's 2026 report locates the target set in the mid-market supplier layer that larger manufacturers buy from, and the Bank of England has already tied one carmaker's shutdown to a slowdown in UK growth figures.
The Watch · Security desk
What happened
- Black Kite counted 1,183 new ransomware incidents against manufacturers in the first seven months of 2026, a 40% increase on the same stretch of 2025.
- European manufacturing victims grew 85% year over year, while the US count came in almost identical to 2025.
- More than 5,000 other companies were affected by Jaguar Land Rover's UK plant shutdown, which stopped daily production of around 1,000 luxury vehicles.
- The UK's Cyber Monitoring Centre put the impact of that incident at GBP 1.9 billion and called it the most economically damaging cyberattack in UK history, ahead of 2017's WannaCry.
Why it matters
- Who's exposed exposure By Black Kite's account the victims are concentrated in the mid-market, so a large manufacturer's exposure sits in the patch state and credential hygiene of firms it does not run and cannot instrument.
- What it costs cost The bill for a production stoppage keeps arriving after the incident is closed: Jaguar Land Rover says it will cut 4,000 jobs and blames the cyberattack.
- Who has to decide decision Anyone holding single-country supply in Germany now has a concrete number to weigh, 77 attacks in seven months against a sector worth a fifth of that economy.
- What doesn't add up contradiction The report's own regional figures imply a rise nearer 45% than the headline 40%, so the growth claim is conservative and the reconciliation turns on how loosely two hedged phrases are read.
Next story · Security · 4d ago
Ahold Delhaize keeps its stores open while some systems stay offline after a cyber incidentConfirmed11 publishers
Black Kite's 40% figure and the Jaguar Land Rover shutdown do not measure the same thing. The comparison runs January to July 2026 against the same months of 2025 [1]. Jaguar Land Rover's UK plants were down through September 2025 [14], outside both windows [33]. The Bank of England suggested that shutdown contributed to a slowdown in national growth figures [16]. The report does not put a cost on the 1,183 incidents it counts [1].
What the count measures is the supplier layer. "The mid-sized manufacturers absorbing most of these attacks are the supplier layer from which larger enterprises assemble their products. When the mid-market is the primary target, a large manufacturer's vendor list is its attack surface," the report said [20]. Black Kite identified 5,237 disclosed victims across manufacturing and distribution between January 2023 and July 2026 [19].
The regional counts add up: 412 in the US, 369 in Europe and 402 in the rest of the world make 1,183 [8][9][10][29]. US volume was almost identical to last year's, so the fall in the US share from 52% to 35% comes from growth elsewhere [6][7][34]. Europe's 85% growth puts the prior-period European figure near 200, an increase of about 169 [6][30]. A near-doubling in the rest of the world adds roughly 197 more [10][31]. Those two increases alone imply a prior total near 817 and a rise closer to 45%, where the stated 40% implies 845 [36][22]. Looser readings of "almost identical" and "almost doubled" close most of that gap.
Half of the 2026 attacks came from groups that did not exist two years ago [21]. The Gentlemen, first seen by Black Kite in September 2025, had claimed 142 manufacturing victims by mid-2026 and accounted for 12% of the year's attacks [3][4]. Twelve per cent of 1,183 is 142 [32]. Qilin leads the current ranking, followed by The Gentlemen, Akira, DragonForce and INC Ransom [5].
Germany took 77 attacks, the highest count in Europe, in an economy where manufacturing was 20% of output in 2024 [11]. SafePay ran 22% of German attacks in 2025 and remains among the most active groups there [12]. Italy recorded 57, the UK 43 and France 40 [13].
"What makes manufacturing and distribution so attractive to ransomware operators is the immediate operational impact," said Ferhat Dikbiyik, chief research and intelligence officer at Black Kite. "One successful attack can stop production lines and disrupt delivery commitments, and every hour of downtime strengthens the attacker's negotiating position." Reconnaissance, he said, "relies on externally visible signals, from unpatched systems and exploitable services to leaked credentials and misconfigured defenses" [23][24].
Distribution runs at lower volume, with smaller victims [25]. The sector recorded 196 incidents in 2025 and 95 in the first half of 2026 [26]. Clop's January and February 2025 campaign alone took 52 of those victims, more than a quarter of the year's total [27]. Excluding it, comparable periods run from 75 in 2025 to 95 in 2026 [28], a 27% rise [35].
What to watch
- Whether The Gentlemen holds a double-digit share of manufacturing victims through the second half of 2026 or fragments.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+12
- Incentives
- Not scored
- Confidence62
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The first seven months of 2026 recorded 1,183 new ransomware incidents against manufacturers, a 40% increase over the same period in 2025.
- [2]
The figures come from the Black Kite 2026 Manufacturing & Distribution Ransomware Report.
- [3]
A single new group, The Gentlemen, was responsible for 12% of this year's attacks.
- [4]
The Gentlemen was first noticed by Black Kite in September 2025 and had claimed 142 manufacturing victims by mid-2026.
- [5]
The current hierarchy of ransomware actors in the sector is Qilin, The Gentlemen, Akira, DragonForce and INC Ransom.
- [6]
The number of US attacks this year was almost identical to 2025, while European targets grew 85%.
- [7]
The US volume of attacks dropped from 52% of the total to 35%.
- [8]
The US remains the most targeted region with 412 attacks.
- [9]
Europe totalled 369 attacks.
- [10]
Attacks against the rest of the world almost doubled, to 402.
- [11]
Germany recorded 77 attacks, and manufacturing in 2024 accounted for 20% of the German national economy.
- [12]
The SafePay group accounted for 22% of 2025 attacks in Germany and remains among the country's most active groups in 2026.
- [13]
Other primary European ransomware victim nations are Italy with 57 attacks, the UK with 43 and France with 40.
- [14]
Throughout September 2025, Jaguar Land Rover shut down its UK plants because of an attack and halted the daily production of around 1,000 luxury vehicles.
- [15]
More than 5,000 other companies were affected by the Jaguar Land Rover shutdown.
- [16]
The Bank of England suggested the Jaguar Land Rover incident was a contributory factor in a slowdown in national growth figures.
- [17]
Jaguar Land Rover has said it will cut 4,000 jobs, blaming the cyberattack.
- [18]
The UK's Cyber Monitoring Centre estimated a GBP 1.9 billion financial impact from the Jaguar Land Rover incident and described it as the most economically damaging cyberattack in UK history, surpassing the 2017 WannaCry outbreak.
- [19]
From January 2023 to July 2026, Black Kite identified 5,237 disclosed ransomware victims across the manufacturing and distribution sectors.
- [20]
"The mid-sized manufacturers absorbing most of these attacks are the supplier layer from which larger enterprises assemble their products. When the mid-market is the primary target, a large manufacturer's vendor list is its attack surface," the Black Kite report said.
- [21]
Half of the 2026 manufacturing ransomware attacks were performed by groups that did not exist two years ago.
- [22]
A 40% rise to 1,183 implies a prior-period total of about 845 incidents.
- [23]
"What makes manufacturing and distribution so attractive to ransomware operators is the immediate operational impact. One successful attack can stop production lines and disrupt delivery commitments, and every hour of downtime strengthens the attacker's negotiating position."
- [24]
"But attackers don't operate blindly. Their reconnaissance relies on externally visible signals, from unpatched systems and exploitable services to leaked credentials and misconfigured defenses."
- [25]
Attacks against the distribution sector are lower in volume than manufacturing, and the victims are smaller.
- [26]
Distribution recorded 95 incidents in the first half of 2026 against 196 for 2025.
- [27]
Distribution volume peaked in 2025 following a Clop campaign in January and February of that year, accounting for 52 victims and more than 25% of the year's total.
- [28]
Excluding the Clop campaign, distribution incidents ran from 75 in the January to June period of 2025 to 95 in the same period of 2026.
- [29]
The three regional counts sum to the stated total of 1,183 incidents.
- [30]
European growth of 85% implies about 200 European victims in the same period of 2025, an increase of about 169.
- [31]
A near-doubling to 402 in the rest of the world implies a prior figure of roughly 205 and an increase of roughly 197.
- [32]
Twelve per cent of 1,183 attacks is 142, the same figure as The Gentlemen's claimed manufacturing victim count.
- [33]
The Jaguar Land Rover shutdown occurred in September 2025 and therefore falls outside both January-to-July periods compared to produce the 40% figure.
- [34]
Because the US count was almost unchanged, the fall in the US share from 52% to 35% is the result of growth in other regions rather than fewer US victims.
- [35]
Distribution incidents excluding the Clop campaign rose about 27% year over year.
- [36]
Taking the US as flat and adding the implied European and rest-of-world prior figures gives a prior-period total near 817 and a year-over-year rise of about 45%.
Sources
2 independent publishers whose own reporting we read for this story.
- infosecurity-magazine.comManufacturing Accounts for 22% of all Ransomware Victims
1 article · September 18, 2026
- securityweek.comRansomware Attacks on Manufacturers Surge as Supply Chain Risk Grows
1 article · September 17, 2026
Topics and entities
Topics
- Ransomware
- Manufacturing Cybersecurity
- Vendor and Supply Chain Security
Entities
- INC Ransom
- The Gentlemen
- Cyber Security and Resilience Bill
- Akira ransomware
- Jaguar Land Rover
- Bank of England
- Cyber Monitoring Centre
- Clop
- Qilin
- DragonForce