Black Kite: Ransomware increasing across all metrics in 2026
Key Highlights
- Black Kite found 7,551 publicly disclosed ransomware victims over the past year, a 24.9% increase, with attacks accelerating in the second half of the reporting period.
- Supply chain vulnerabilities remain a major risk, while AI is helping ransomware groups speed up attacks and improve extortion efforts.
- Manufacturers continue to be a top target, and Black Kite recommends focusing on patching known vulnerabilities, strengthening vendor oversight, and preparing for AI-driven threats.
This year is shaping up to be another record-breaking year for ransomware attacks, with the amount of publicly disclosed victims having already increased by almost 25% from last year, according to one new report.
In 2026, ransomware incursions have grown by 60% during the second half of the reporting period for Black Kite, vendor of a cyber risk management platform.
The cyber surveillance company’s 2026 Ransomware Report: Why Every Year Becomes the Worst Year on Record monitored activity from almost 300 ransomware groups from April 1, 2025, through March 31, 2026.
Within that time, the firm identified 7,551 publicly disclosed ransomware victims, up 24.9% from the previous reporting period. Attacks accelerated by 60% during the second half of that reporting period, but the first half, from April to September 2025, produced 2,904 victims. From Oct. 2025 to March of this year, ransomware disclosures rose to 4,647 victims.
See also: Black Kite: Data breaches escalate to records amid slow disclosure by supply chain companies
Black Kite also identified 146 active ransomware groups by June 2026, including 61 new actors entering during the reporting period.
The report was released as manufacturers continue to struggle with ransomware and cyberattacks, as concerns rise in supply chain risks, business ecosystems, financial impacts of attacks, and overall safety issues when preparing for such incidents.
Analysis sees
attack locations
Another recent study found that data breaches also vary by business and location.
For example, Washington, D.C., records the highest rate of business data breaches in the U.S., with 42.24 breaches per 100,000 residents in the last 12 months, according to data analyzed by SiteGround.
This likely is influenced by the large number of federal agencies and government entities in the District that hold sensitive data that could be attractive to attackers.
Nevertheless, the research revealed that breaches come with whopping costs. Two specific states that suffer the highest costs: New Hampshire and Vermont. Cyber incidents cost firms located there an average of $116,000 per claim last year.
D.C. was first, but New Hampshire experienced the second highest rate, with 26.99 business data breaches per 100,000 residents in the last year. The Granite State has a preponderance of industries that process sensitive personal and financial information, possibly contributing to its ranking, according to SiteGround.
Vermont ranks third with 26.84 business data breaches per 100,000 residents. The largest industries by revenue there are life insurance and hospitals, which have generated $3.7 billion and $3.5 billion in 2026.
Aside from manufacturing, health care is among the highest sectors to be targeted by cyberattackers. Health care handles sensitive customer or patient information and large financial transactions, making many of the firms located in Vermont a top target.
SiteGround sourced its analysis from several organizations or reports: Coalition Inc; the ID Theft Resource Centre; and Verizon's 2026 Data Breach Investigations Report; and where New Hampshire and Vermont were concerned, the State of New Hampshire Workforce Plan (2025–2026), and the IBIS World Vermont State Economic Profile.
The No. 4 through No. 10 states where businesses suffer the most data breaches were Maine, Massachusetts, Minnesota, Connecticut, Rhode Island, Washington, and Delaware.
Manufacturers were hit the hardest by ransomware attacks last year, with a 58% year-over-year increase in victims, according to one study.
'Defining pressures’ and AI as ‘attack chain glue’
Black Kite also reinforced why supply chain exposure is a concern, calling it “one of the year’s defining ransomware pressures.”
The report found that major incidents centered on the systems around breached companies, such as vendor platforms, SaaS integration, ERP applications, and data stores.
The report states that since organizations cannot directly patch a vulnerability it does not own on a platform it does not run—often through a vendor relationship—an attack path can form.
Other key findings of the report include:
-
Qilin, the Ransomware-as-a-Service operation, claimed more than 1,300 victims, nearly twice as many as the nearest threat actor.
-
Over 40% of victims still carried critical patch vulnerabilities in the latest assessment, and 30.8% carried KEV exposure.
-
About 175% higher stealer log exposure in the before-and-after security posture comparison.
-
Oracle E-Business Suite and Salesforce ecosystem integrations defined several of the year's most visible supply chain incidents.
AI also is being used to accelerate attacks. The Black Kite report identified two different ways AI is entering the ransomware cybercrime business: as support for technical execution and as language for extortion pressure.
Black Kite called AI “attack-chain glue,” as it connects existing tactics, reduces the time between stages and raises the baseline quality of criminal operations.
Intel about post-incident periods
Black Kite named a few ways manufacturers can mitigate the risks of attacks as well as how to effectively respond to an incident.
For example, the report found that after an attack, Black Kite’s Ransomware Susceptibility Index actually increases; during the post-incident period, organizations should have a structured 30-, 60-, and 90-day external exposure review covering stealer logs, KEV exposure, critical patch vulnerabilities, remote access, SaaS integrations and vendor-managed access.
See also: Crystal Ball 2026: AI-driven cyberattacks are coming. Here’s how to prepare now
Other advice from Black Kite’s report included:
-
Prioritizing what attackers already exploit, such as KEV and critical patch vulnerabilities.
-
Extending visibility to include vendor identity, SaaS access and application vulnerability exposure, not only questionnaire-based assessments.
-
Reinforcing the human layer through phishing training, hardened help desk verification, and stronger identity recovery procedures.
-
Preparing for AI-augmented social engineering and threat actors.
About the Author
Sarah Mattalian
Staff Writer
Sarah Mattalian is a Chicago-based journalist writing for Smart Industry and Automation World, two brands of Endeavor Business Media, covering industry trends and manufacturing technology. In 2025, she graduated with a master's degree in journalism from Northwestern University's Medill School of Journalism, specializing in health, environment and science reporting. She does freelance work as well, covering public health and the environment in Chicagoland and in the Midwest. Her work has appeared in Inside Climate News, Inside Washington Publishers, NBC4 in Washington, D.C., The Durango Herald and North Jersey Daily News. She has a translation certificate in Spanish.