During 2026, the manufacturing sector solidified its position as the most targeted industry for ransomware attacks globally, a trend that — far from being temporary — has accelerated alarmingly.
According to data from Black Kite, manufacturing accounted for more than 21% of all ransomware victims between April 2025 and March 2026, making it the most targeted sector for the fifth consecutive year. But the most concerning part isn't that it remains in first place — it's how fast it's growing: the volume of ransomware incidents in manufacturing rose nearly 40% year-over-year between January and July 2026, climbing from 847 to 1,183 cases.
📊 By the numbers:
- 1,560 attacks on manufacturing in the past 12 months — 27.1% of the global total (Bitsight)
- +40% year-over-year increase in incidents in 2026 (Black Kite)
- Manufacturing, the #1 sector for ransomware for 5 consecutive years
Other threat intelligence firms confirm the same pattern. GuidePoint Security documented that manufacturing remained the most impacted industry during the first quarter of 2026. Data from Ransomware.live, the most widely consulted open-source threat intelligence tool in the community, also places manufacturing among the sectors with the highest number of publicly disclosed victims in 2026, second only to technology.
The case that put the problem on the table: Jaguar Land Rover
If there's one incident that perfectly illustrates the risk manufacturing faces today, it's the cyberattack suffered by Jaguar Land Rover (JLR) in late August 2025.
The attack, attributed to the collective Scattered Lapsus$ Hunters (an alliance of the Scattered Spider, Lapsus$, and ShinyHunters groups), forced the company to completely shut down its global IT systems to contain the breach.
The result was devastating:
- Production halted for 5 weeks
- Direct cost of £196 million in the second quarter alone
- Total estimated economic impact of £1.9 billion
- 43% drop in production in the fourth quarter of 2025
"The most economically damaging cyberattack in UK history, surpassing even the 2017 WannaCry outbreak." — Cyber Monitoring Centre (CMC)
JLR wasn't an isolated case, but rather the most visible example of a structural problem hitting the entire manufacturing supply chain.
What's changing? Three factors driving the surge
IT/OT convergence has shifted digital risk onto the factory floor
For years, operational technology (OT) environments — the networks that control machinery, assembly lines, and industrial systems — remained relatively isolated from corporate IT networks. That separation has disappeared.
As Robert Lee, CEO of Dragos, summarized in February 2026:
Industrial organizations consistently underestimate how far ransomware can reach into their OT environments because they assume the risk is exclusively an IT problem.
Dragos's data backs up this warning:
| Organization type | Average containment time |
|---|---|
| With full OT visibility | 5 days |
| Industry-wide average | 42 days |
That nearly 40-day gap is, literally, the extra time attackers have to move laterally, exfiltrate data, and pressure the victim before being discovered.
Legacy systems have left much of the sector outdated and unpatched
Many manufacturing plants operate industrial control systems (SCADA/ICS) installed over a decade ago, designed to run for decades in operation — not to receive constant security updates.
Updating or replacing this infrastructure means shutting down entire production lines, something many companies have avoided by delaying modernization. The result: a technology fleet with known vulnerabilities, exposed and difficult to protect with modern security tools.
Operational pressure makes paying the ransom more likely
Unlike an attack on a database, ransomware that halts a production line generates immediate, measurable losses: in JLR's case, losses were estimated at between £5 and £10 million per day during the disruption.
Black Kite notes that this certainty of immediate impact is precisely what makes manufacturing so attractive to ransomware operators. In addition, the victim profile is shifting toward the mid-market supplier layer, which forms the backbone of large automakers' supply chains:
"When the mid-market is the primary target, a large manufacturer's vendor list becomes its own attack surface." — Black Kite, Manufacturing & Distribution Ransomware Report 2026
The ransomware groups behind the wave
| Group | Profile |
|---|---|
| Qilin | Most active against manufacturing in 2026 — 178 victims in 7 months |
| The Gentlemen | New group (Sept. 2025) — already 142 victims, 23% of its total activity |
| SafePay | Heavy concentration on European targets, especially Germany |
| Akira / Play / INC Ransom | Veteran groups with cross-industry impact |
| DragonForce | Active against manufacturing in North America since early 2026 |
| Scattered Lapsus$ Hunters | Collective responsible for the JLR attack |
The takeaway
Manufacturing isn't a random target: it's a sector where outdated systems, IT/OT convergence that multiplies the attack surface, and a level of operational pressure that turns every minute of downtime into millions in losses all converge.
Unless that combination of factors changes, the industry is likely to keep topping the ransomware victim lists in the years ahead.
References
Manufacturing Accounts for 22% of all Ransomware Victims – Infosecurity Magazine
Author: Edu Quijano