Manufacturing Ransomware in 2026: The Median Victim Books $42.9 Million

The revenue profile of the average victim, drawn from 4,077 manufacturing victims whose revenue could be verified.

The typical manufacturing ransomware victim is a mid-market company. Black Kite puts the median at $42.9 million in annual revenue, and 70.2% of 2026 victims with known revenue sit in the $10 million to $100 million band. In 2023 that band held 54.3%. The concentration has been deepening every year since.

The volume is going the same direction. Black Kite tracked 540 disclosed manufacturing incidents in 2022, 926 in 2023, 1,071 in 2024 and 1,600 in 2025. The first seven months of 2026 produced 1,183 on their own, already past the full-year totals for 2023 and 2024. Compared like for like against the same January-to-July window, that is 39.7% growth over 2025, which had itself grown 42.8% over 2024.

Look at what happened in 2024, the year law enforcement dismantled LockBit and disrupted Clop. Ransomware disclosures in financial services fell 18.8%. Manufacturing grew 15.7% straight through the takedown year, then accelerated 49.4% in 2025. Whatever slowed operators elsewhere did not slow them here.

The largest manufacturers have not been dropped from the list. Victims above $1 billion in revenue appear in every year of the data: 108 in 2023, 64 in 2024, 73 in 2025, 45 in the first seven months of 2026. Their share fell from 13.1% to 5.3% because the base underneath them got much wider. Victims under $10 million rose from 14.0% to 17.3% over the same stretch.

Size shows up again in outcomes. Sophos surveyed 2,158 IT and security decision-makers for its State of Ransomware 2026 report and found that only 34% of organizations with 100 to 250 employees stopped an attack before encryption or extortion, against 46% at companies with 3,001 to 5,000 employees. Smaller companies are not hit less often. They finish the incident worse.

• Enough revenue to be worth extorting. A $40 million manufacturer can pay something, and the attacker knows it.
• Contractual delivery obligations. Every hour of downtime raises the cost of saying no, and that pressure is what a ransom note is built on.
• Shared technology patterns. The same remote-access tools, the same file transfer platforms, the same unpatched appliances turn one campaign into dozens of victims.

What the victims looked like from outside their own networks on the day their names appeared.

There was warning, and it was public. Black Kite scored each victim on its Ransomware Susceptibility Index, a 0 to 1 measure of externally visible exposure, at the moment of disclosure. 74.4% of manufacturing victims were already above 0.4, the critical threshold. The average victim scored 0.552, and 35.1% stood at 0.6 or higher.

Those bands carry measured odds. Companies scoring above 0.8 are 291 times more likely to be attacked than those below 0.2; in absolute terms 41% of the top band was hit, against 0.14% of the bottom. The 0.4 to 0.6 band runs 36 times more likely. The 0.6 to 0.8 band runs 54 times.

Two named cases show the score doing its job before anyone knew there was a story. When Coca-Cola's Fairlife dairy unit was hit, its scan stood at 0.58. Asahi, which lost 30 factories and kept six breweries closed for a week, stood at 0.778. Asahi later reported the attackers reached its network through equipment at a group site and used a weak password to get administrative privileges. No zero-day. A password.

The finding mix at disclosure is where this gets practical. Misconfiguration topped the finding list in every year measured, at 83.7% of 2023 victims and still 71% in 2026. Exposed remote access ports never moved at all: 51.3% in 2023, 51.9% in 2026. Roughly half of victims carried an exploitable software vulnerability in every year measured.

Black Kite also rescanned the largest manufacturers, companies above $1 billion in revenue, and that cohort is the best case the sector has. 74.8% carry a critical vulnerability at CVSS 8 or above, 54.2% carry a flaw from CISA's Known Exploited Vulnerabilities catalog, and 69.1% have credentials circulating in stealer log markets. Between 2024 and 2026 the patch numbers improved, with KEV exposure falling from 67% to 54.2%. Credential exposure went from 69% to 69.1%. It did not move, because a vulnerability list has an end state and an infostealer infection on a contractor's laptop does not.

Houston businesses can check this from the same vantage point, because CinchOps already did. The Houston Area Security Index scanned 955 Houston-area manufacturers from outside their networks and graded 954 of them. The grade point average is 1.57, 46.6% of those plants sit at a D or an F, and three earned an A. DNS scored worst, with 510 plants at an F, and 602 graded a D on network security. Black Kite says the outside grade predicts the victim. Houston's outside grades are already published, and most owners here have never looked at their own.

Trucking, freight arrangement and warehousing, analyzed as their own industry rather than as an appendix to manufacturing.

Distribution is its own target class. Black Kite identified 457 disclosed ransomware victims across trucking, freight arrangement and warehousing between January 2023 and July 2026, and the median revenue-known victim generates $28.7 million a year, well below manufacturing's $42.9 million. 68.6% sit in the $10 million to $100 million band.

General freight trucking carries the largest share at 210 victims, 46% of the leg. Freight transportation arrangement follows with 127, warehousing and storage with 80, and specialized freight trucking with 40.

The year counts look like the pressure eased: 63 incidents in 2023, 103 in 2024, 196 in 2025, then 95 in the first seven months of 2026. A single Clop campaign in January and February 2025 produced 52 of that year's distribution victims in eight weeks, 26.5% of the annual total. Strip that campaign out and the same-period baseline grew 26.7%, from 75 to 95. The campaign wave receded. The underlying growth kept going.

Regulation is thinnest exactly here. General freight trucking sits outside the core annexes of the EU's NIS2 Directive, outside the scope of the UK's Cyber Security and Resilience Bill, and outside any binding US federal cyber mandate, even while ports, rail and couriers pick up obligations. In a Houston metro built around a port, a petrochemical complex and the warehouse corridors running out through Katy, Cypress and Rosenberg, the least-regulated node in the chain is the one most of the freight actually passes through.

How a single manufacturing or logistics outage travels up and down the chain, with the measured numbers from two 2025 incidents.

A manufacturer sits in the middle of the supply chain, not at its edge. When Jaguar Land Rover shut down its own global IT systems on September 2, 2025 to contain an attack, production stopped for more than five weeks at three UK plants that together build roughly 1,000 vehicles a day, at a cost near 50 million pounds a week.

The UK's Cyber Monitoring Centre rated it a Category 3 systemic event, estimated the financial impact at 1.9 billion pounds across more than 5,000 affected organizations, most of them small and mid-sized suppliers, and called it the most economically damaging cyberattack in UK history. The Bank of England's November 2025 Monetary Policy Report named the attack as a reason third-quarter GDP came in at 0.2% instead of the projected 0.3%. Coventry-based supplier Evtec Group put 900 employees on short-time work and reported its own loss at 13 million pounds.

The cascade also runs upward, through shared software. Clop's campaign against the Cleo managed file transfer platform produced 128 manufacturing victims and 52 distribution victims in eight weeks, from a group that had recorded 11 manufacturing incidents in all of 2024. The Oracle E-Business Suite campaign that followed skewed the other way, with 28.3% of victims above $1 billion in revenue, four times the dataset baseline, because an enterprise application's customer list is an enterprise victim pool. A software vendor's exposed system is part of a manufacturer's ransomware surface whether or not it appears on any asset inventory.

Naming the group that will hit you is a losing game. 588 of the 1,183 manufacturing incidents in 2026, or 49.7%, were claimed by actors that did not appear in this dataset at all in 2023 or 2024, and the count of distinct active groups grew from 55 to 91. Qilin led 2026 with 178 manufacturing victims and The Gentlemen took second with 142, from a group that did not exist in the data before September 2025. LockBit 3.0 led the sector in 2023 with 212 incidents and recorded none in 2026.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area. CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10 to 200 employees.

That customer size is the same band this report identifies as the center of gravity for manufacturing ransomware, so the work below is written for it rather than scaled down from an enterprise program.

• Through manufacturing IT services, CinchOps segments the shop floor from the corporate network at the IT and OT-SCADA boundary, so an email click in accounting does not reach a PLC.
• Cybersecurity services cover the finding types this report ranks highest: exposed remote access, unpatched systems, leaked credentials and mail authentication that lets someone else phish your customers in your name.
• Business continuity and disaster recovery keeps immutable, verified backup copies geo-redundant outside the Gulf Coast flood zone, which matters in a metro whose hurricane season runs June 1 to November 30.
• Managed IT support answers help desk requests in under 15 minutes with a named engineer who knows the network, on a Zero-Zero-Zero model: no long-term contracts, no hidden fees, no cancellation penalties.
• Coverage runs across Houston, Katy, Cypress and Rosenberg, and into related verticals including oil and gas, energy and utilities and construction.

The uncomfortable part of this report is also the useful part. If three out of four victims were visibly exposed before anything happened, then the list of things to fix was sitting in public the whole time, and a Houston manufacturer or freight operator can pull that same list this quarter without waiting for a customer questionnaire to force it. Start with what is reachable from the internet, fix the credential side rather than only the patch side, and get the backups somewhere a Gulf storm cannot reach. If you want a second set of eyes on the result, talk to CinchOps.