01 | RANSOMWARE TRENDS
Ransomware in Manufacturing: Still the #1 Target, Four Years and Counting
For the fourth consecutive year, manufacturing is the number one target for ransomware groups.
Between April 2024 and March 2025, the industry accounted for almost one-quarter (22%) of all publicly disclosed attacks (1,314 attacks on manufacturing of 6,046 total attacks). The manufacturing industry far surpassed the next closest industry, Professional and Technical Services, in ransomware victims.
This continued focus on manufacturing is particularly noteworthy given the significant upheaval in the ransomware landscape during this period. The demise of dominant groups like LockBit and AlphV created a power vacuum from which dozens of new, less coordinated, and unpredictable players emerged. (Read more about the this power struggle in our 2025 Ransomware Report: How Ransomware Wars Threaten Third-Party Cyber Ecosystems.)
These newer ransomware groups favor smaller companies, but large manufacturing enterprises are still very much a target, accounting for the greatest share of ransomware attacks on companies earning $100 million to $1 billion or more. This means the industry is getting hit from all sides by ransomware groups.
of all publicly disclosed attacks affect the manufacturing industry
Ransomware Attacks Across Industries
Ransomware by the Numbers: All US Sub-industries Are Targets
Within the manufacturing sector itself, the attacks were distributed widely across sub-industries, demonstrating that the "type" of manufacturing matters less to ransomware players than a manufacturer's central role in industry workflows. Attacks on Machinery Manufacturing were the most frequent at 13%, followed closely by Fabricated Metal Product Manufacturing (12%) and Food and Beverage Manufacturing (11%). These attacks are heavily concentrated on the U.S. manufacturing supply chain, with the country absorbing a staggering 52% of all attacks on the sector globally.
Ransomware Attacks by Manufacturing Subindustry
Ransomware Attacks on Manufacturing Companies Across Countries
The Story of Revenue: Ransomware Groups Aim Higher With Manufacturing
While our 2025 Ransomware Report noted a general shift by ransomware groups to target smaller businesses, manufacturing remains ransomware's favorite high-value target, particularly for larger enterprises.
The data shows that for companies earning between $100 million and $300 million, manufacturing accounts for 30% of ransomware victims, the most of any industry. This trend only strengthens with revenue, as manufacturing comprises a staggering 39% of ransomware victims among companies earning over $1 billion.
These findings highlight that manufacturing enterprises, with their complex operational technology (OT), global exposure, and intricate digital footprints, are particularly attractive to well-resourced attackers.
Meanwhile, smaller manufacturing companies are still very much a ransomware target. It’s the second-most attacked industry, accounting for 17% of ransomware attacks on companies with revenues less than $20 million.
Top Targeted Industries for Companies with $100M–$300M Annual Revenue
Top Targeted Industries for Companies with >$1B Annual Revenue
Top Targeted Industries for Companies with<$20M Annual Revenue
This dual approach—targeting both smaller, vulnerable supply chain partners and high-value direct targets—means the manufacturing sector faces threats from all angles.
Studying past attacks is enlightening, but the real question is, where is the next ransomware campaign likely to hit?
Future Attacks: Get Ahead of the Next Ransomware Campaign
Beyond historical data, Black Kite's Ransomware Susceptibility Index (RSI™) serves as a predictive metric to gauge the likelihood of a company falling victim to an attack. The RSI is a numerical score between 0.0 and 1.0 that incorporates both technical vulnerabilities and intrinsic risk factors that ransomware groups exploit.
Ransomware Likelihood Based on RSI Score
Nearly all manufacturing sub-industries have an average RSI score of 0.4 or greater, placing them in the “yellow” high-risk category or above. This is a critical finding, as companies in this range are at least 11.6 times more likely to experience a ransomware attack compared to those with a score below 0.2. Companies with an RSI score of 0.8 to 1.0 are in the most severe category, as they are 96 times more likely to experience a ransomware attack than those with a score below 0.2.
RSI Averages in Manufacturing, Ranked by Number of Companies
RSI Distribution in Manufacturing
An even closer look at the RSI scores within each sub-industry reveals significant areas of concern. For example, in the Furniture and Related Product Manufacturing sub-industry, 76% of companies have an RSI score above 0.4, indicating a very high susceptibility to ransomware. In comparison, 25% of companies in the Petroleum and Coal Products Manufacturing sub-industry fall within this same high-risk range.
RSI Distribution in Manufacturing by %