Ransomware Disclosures Climb to 7,551 Victims in 2026, Up 24.9% Year Over Year

The Numbers Behind the Climb

Black Kite’s 2026 ransomware report tracked 7,551 victims disclosed between April 2025 and March 2026, up from 6,046 in the prior 12-month period — a 24.9% year-over-year increase. That translates to a monthly average climbing from roughly 504 victims to 629. The acceleration wasn’t even across the period: the first half of the reporting window saw 2,904 victims, while the second half recorded 4,647 — a pace roughly 60% higher than the first half, with March 2026 alone logging 861 victims, which Black Kite describes as the highest single month it has recorded since it began tracking disclosures.

The threat-actor ecosystem also expanded. Black Kite counted 127 active ransomware groups at the close of the reporting period, rising to 146 by June 2026, with 61 new groups entering during the period — evidence that the barrier to launching a ransomware operation keeps falling even as defenses improve.

Manufacturing Bears the Brunt

Manufacturing led all sectors in ransomware victims for the fourth consecutive year, accounting for 1,660 victims — 22.0% of all disclosures, according to Black Kite’s sector breakdown. Professional and Technical Services followed with 1,389 victims. The concentration in manufacturing is notable because that sector is disproportionately exposed to supply-chain disruption: a ransomware attack that halts production at one supplier can cascade through downstream customers who have no direct relationship with the attacker and no visibility into the breach until shipments stop.

The data also shows a shift in which companies attackers are targeting by size. Black Kite’s revenue-band analysis found the $50 million to $100 million range climbed from 25.1% to 29.3% of victims, while the $100 million-plus tier fell from 13.9% to 9.5% — a pattern consistent with attackers moving toward mid-sized firms that may have real assets to extract ransom from but weaker security budgets than the largest enterprises.

Why Disclosures Keep Rising Even as Companies Patch

One of the more striking findings in Black Kite’s report is how often known vulnerabilities remain unresolved even after an attack becomes public. 43.5% of victims still carried critical patch vulnerabilities upon rescan after their incident, and 30.8% retained known exploited vulnerabilities — meaning nearly a third of breached organizations left the same class of weakness that enabled the attack unaddressed even after the incident was disclosed. That gap between disclosure and remediation is arguably as important as the headline victim count: it suggests the four-year growth trend in ransomware disclosures isn’t purely a function of more attackers, but also of defenders who are slow to close the door once it’s been kicked in.

1. Treat post-incident vulnerability rescans as mandatory, not optional

Nearly a third of breached organizations retained the exact vulnerability class that enabled their attack. A rescan and remediation step immediately after any incident — not just a forensic report — closes the gap attackers are most likely to exploit again.

2. Budget security spend by sector exposure, not company size alone

The shift toward $50-100 million revenue-band victims shows attackers are following softer security budgets, not just bigger payouts. Mid-sized firms in exposed sectors like manufacturing need security budgets sized to their risk profile, not their historical spend.

3. Map supply-chain ransomware exposure, not just direct exposure

With manufacturing leading disclosures for four straight years, any company sourcing from manufacturing suppliers should ask those suppliers about ransomware incident history and patch practices as a standard vendor-risk question, not an afterthought.

Frequently Asked Questions

Sources & Further Reading

• 2026 Ransomware Report — Black Kite