Ransomware in Manufacturing, 2026:
One of the Hardest-Hit Sectors

Even in 2026, ransomware remains one of the most significant cyber threats facing companies worldwide. An analysis of Ransomware.live, a platform that aggregates and continuously updates information on publicly disclosed victims of ransomware groups, reveals that manufacturing is among the sectors most heavily affected.

Based on incidents publicly documented by attackers, more than 800 ransomware victims have already been recorded so far in 2026. These attacks can be attributed to 315 active ransomware groups. However, the true number of successful attacks is likely much higher, as many incidents are never made public.

Within this overall dataset, the manufacturing sector stands out in particular. It has the second-highest number of victims across all industries, ranking just behind technology and ahead of traditional targets such as healthcare, finance, and retail. This ranking shows that ransomware attacks against manufacturing companies are no longer isolated events - they are the norm.

AMDT Image

Based on incidents publicly documented by attackers, more than 800 ransomware victims have already been recorded so far in 2026. These attacks can be attributed to 315 active ransomware groups. However, the true number of successful attacks is likely much higher, as many incidents are never made public.

Within this overall dataset, the manufacturing sector stands out in particular. It has the second-highest number of victims across all industries, ranking just behind technology and ahead of traditional targets such as healthcare, finance, and retail. This ranking shows that ransomware attacks against manufacturing companies are no longer isolated events - they are the norm.

The Most Active Ransomware Groups in 2026

An analysis of published victim data reveals that a core group of highly active ransomware actors has emerged. The most frequently observed ransomware groups at present include:

  • SafePay: Very high activity and highly industrialized attack campaigns
  • RansomHub: A rapidly growing group with a high rate of public disclosures.
  • Akira: Focuses on Windows and Linux environments and frequently attacks mid-sized and large enterprises.
  • Qilin: Internationally active and repeatedly targets industrial and manufacturing companies.
  • Cl0p: Known for attacks via third-party software and supply-chain vectors.
  • LockBit: Still relevant despite government countermeasures.

These groups operate across industries and often follow the same patterns: a clear division of labor, a high degree of automation, and the use of double-extortion models. In these models, attackers encrypt data and threaten to publish sensitive information. These groups are particularly successful in environments with complex IT and OT landscapes, which is a defining characteristic of modern manufacturing operations.

Top 5 Countries by Ransomware Victims

In addition to the sector-based view, data from Ransomware.live also reveals a strong geographic concentration of ransomware activity. The majority of publicly documented cases occur in a relatively small group of economically strong countries:

  1. United States
  2. Germany
  3. Canada
  4. United Kingdom
  5. India

The most striking aspect is the enormous gap between the United States and all the other countries on the list. The U.S. reports a victim count that is several times higher than that of any other ranked country.

AMDT Image

In addition to the sector-based view, data from Ransomware.live also reveals a strong geographic concentration of ransomware activity. The majority of publicly documented cases occur in a relatively small group of economically strong countries:

  1. United States
  2. Germany
  3. Canada
  4. United Kingdom
  5. India

The most striking aspect is the enormous gap between the United States and all the other countries on the list. The U.S. reports a victim count that is several times higher than that of any other ranked country.

What Does This Mean for Manufacturing Companies?

The numbers make one thing clear: ransomware poses an immediate threat to production operations. One of the most effective foundational measures for safeguarding OT/ICS networks is establishing a clear and consistently enforced separation between IT and OT systems. IT systems should not be able to establish connections to the OT network or retrieve data from it. Instead, OT systems should be configured to transmit information to the IT network in one direction only.

To effectively secure their manufacturing processes, companies must maintain continuous visibility into their assets, deployed software, software versions, and the dependencies between IT and OT. This information must be available during day-to-day operations, not compiled for the first time during an incident.

Organizations that systematically document their OT environments, track changes to equipment and systems, and integrate security considerations into daily production processes early on are better positioned to detect attacks sooner, limit downtime, and restart production in a more controlled and timely manner.

AMDT Image

OT security is key to production resilience. The OT Security Landscape Report offers insight into the current state of OT security within organizations.