‍

Manufacturing has become the most heavily targeted sector for ransomware attacks in 2026, and cyber-security experts say the consequences are moving beyond companies breached directly, rippling through their suppliers, contractors, and logistics partners.

According to threat intelligence firm ReliaQuest's Q2 2026 ransomware report, manufacturing accounted for roughly 19.5% of all ransomware and cyber extortion incidents tracked during the quarter, with at least 374 attacks recorded against manufacturers globally, the highest volume of any industry. The ransomware group Qilin was the most active operator overall, claiming at least 295 incidents across multiple sectors, while a group tracked as "The Gentlemen" focused on manufacturing, professional services, retail, and food service. A separate group, Akira, focused heavily on manufacturing and construction targets.

Although North America continued to see the highest volume of incidents, accounting for nearly 45% of all ransomware and data extortion incidents, ReliaQuest notes the global ransomware landscape is becoming increasingly geographically diverse.  Despite the declining share, ransomware activity North America still increased 9.6% year-over-year, with Europe-based organizations seeing the second highest number of incidents.

Researchers point to a shift in hacking strategies as one reason manufacturers are under pressure. Instead of using traditional tactics in which groups encrypt files and demand payment, attackers are stealing proprietary data before triggering encryption, then using the threat of a public data leak as a second point of leverage even when a company can restore operations from backup.

The Supply Chain Multiplier

The bigger concern for the industry may be how far a single cyber-security breach can travel. The risk of exposure to ransomware attacks is amplified by the way manufacturing supply chains are structured. Manufacturers typically depend on a web of contract producers, logistics partners, cloud and SaaS providers, ERP and MES software vendors, automation suppliers, and managed service providers; many of which hold privileged permissions into a company’s systems.

Organizations with subsidiaries or outsourced IT operations arguably face more exposure, since those additional stakeholders often receive access to a parent company's systems through shared identity platforms or ERP integrations. This, in turn, means an incident at a smaller partner can disrupt a much larger organization further up the chain.

What Manufacturers Are Being Advised to Do

Security researchers tracking the trend are directing manufacturers to move from one-time vendor assessments to continuous supply chain risk management. Commonly cited recommendations include auditing multi-factor authentication coverage, tightening vulnerability measures for internet-facing systems, running regular security checks of suppliers and partners, and testing backup & incident-response plans under realistic threat situations.

Several experts also recommend moving to zero trust architecture. This strategy limits access and verifies users and devices throughout a network, rather than relying on a secured perimeter, as a longer-term structural response to a threat environment where the weakest link is often outside a company's own infrastructure.

Read More at ZeroFox.com

‍