Loading story…
Ransomware continues to pose a significant threat to the manufacturing and logistics industries, with attackers increasingly targeting these sectors due to their critical role in global supply chains. According to Black Kite's 2025 Manufacturing Research Report, manufacturing has been the top target for ransomware groups for four consecutive years, accounting for 22% of all reported attacks between April 2024 and March 2025. This equates to 1,314 attacks out of a total of 6,046, highlighting the persistent focus of cybercriminals on this sector. The report notes that while newer ransomware groups may favor smaller companies, large manufacturing enterprises remain highly attractive targets due to the potential for widespread operational disruption. Attackers are not acting indiscriminately; they deliberately target manufacturing because any interruption can have cascading effects throughout the supply chain. The evolution of ransomware tactics is also notable, with some groups shifting from traditional encryption-based extortion to pure data theft and extortion, and others leveraging artificial intelligence to enhance their attacks. The Dragos Industrial Ransomware Analysis for Q2 2025 corroborates these findings, emphasizing that manufacturing remains the most impacted sector. Companies are responding by strengthening their cybersecurity postures, particularly through improved patch management protocols and increased awareness of the threat landscape. The logistics sector has also been severely affected, as illustrated by the ransomware attack on Kantsu, a midsize Japanese logistics company. On September 12, 2024, Kantsu's internal network and all systems were locked by ransomware, halting shipping operations and cutting off communications both internally and externally. The attack rendered all company data unavailable, impacting over 500 partner companies and threatening the very survival of the business. Kantsu's experience underscores the importance of business resilience and the need for robust incident response plans. The company, which had invested in cloud-based warehouse management systems to streamline operations, found itself grappling with the operational and reputational fallout of the attack. The incident highlights the broader trend of ransomware groups targeting organizations whose operational continuity is vital to the functioning of other businesses. Both manufacturing and logistics companies are increasingly aware that their critical position in supply chains makes them prime targets for cybercriminals. As a result, there is a growing emphasis on proactive defense measures, including timely software updates, employee training, and the adoption of advanced security technologies. The ongoing battle between ransomware actors and these industries is driving innovation in both attack techniques and defensive strategies. The stakes are high, as successful attacks can disrupt not only individual companies but also the broader economy. The need for cross-sector collaboration and information sharing has never been greater, as organizations seek to stay ahead of evolving threats. Ultimately, the fight against ransomware in manufacturing and logistics is an escalating battle, with both sides adapting rapidly to new challenges and opportunities.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Reporting described ransomware as an intensifying threat to factory-floor and industrial environments, reflecting a broader escalation in attacks against manufacturing and OT operations. The coverage frames this as an ongoing trend rather than a single newly disclosed breach.
A ransomware attack hit Japanese logistics company Kantsu, creating a business resiliency crisis and forcing the company to respond to operational disruption. The incident is described retrospectively in reporting on the company's response measures.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Japanese companies, including major manufacturers and retailers such as Asahi Holdings and Askul, have experienced prolonged operational disruptions following ransomware attacks. Asahi Holdings continues to face back-office issues and has acknowledged a potential data breach affecting 1.9 million individuals, while Askul only recently resumed partial operations after more than six weeks of downtime, with ongoing shipment delays. These incidents highlight the extended recovery periods for Japanese firms, especially when ransoms are not paid, and the broader impact on supply chains, as seen with Muji's halted sales due to Askul's outage. Globally, the manufacturing sector has shown some improvement in defending against ransomware, with only 40% of attacks resulting in data encryption compared to 74% the previous year. However, data theft remains a significant risk, with 39% of affected manufacturers suffering data loss, and more than half still paying ransoms despite better defenses. The sector continues to face challenges such as skilled labor shortages, unknown vulnerabilities, and increased stress on IT and security teams, with nearly half reporting heightened pressure and a notable proportion experiencing leadership changes after attacks.
Jun 29, 2026
Ransomware attacks have reached unprecedented levels globally, with the third quarter of 2025 witnessing a 36% year-over-year increase in publicly disclosed incidents, according to BlackFog’s latest report. The total number of ransomware attacks reported in this period climbed to 270, marking a 335% rise since Q3 2020. These attacks have caused significant operational disruptions across various sectors, including airlines, automotive manufacturers, governments, and organizations in 93 countries. Notable incidents include grounded aircraft, stranded passengers, and manufacturers such as Jaguar Land Rover being forced to halt production, with some operations only recently resuming after prolonged outages. The impact of ransomware extends beyond large enterprises, severely affecting small businesses that often lack the resources and security infrastructure to defend against such threats. Many small business owners have reported devastating financial consequences, with some losing nearly all their savings and seeing their businesses shrink dramatically. The attack on the UK nursery chain Kido in September 2025 highlighted the evolving tactics of ransomware groups, as sensitive data on children, parents, and carers was exfiltrated, raising concerns about the targeting of vulnerable sectors. Ransomware operators are increasingly indiscriminate, targeting organizations of all sizes and types, and seeking leverage through data theft and extortion. The psychological and financial toll on victims is profound, with individuals and organizations facing long-term recovery challenges. Research indicates that small businesses are particularly vulnerable, often lacking dedicated IT security staff, legal support, or sufficient cash reserves to weather the aftermath of an attack. The stress and adversity experienced by victims underscore the need for robust data protection and incident response strategies. Experts emphasize that the best defense is to make it as difficult as possible for cybercriminals to succeed, focusing on data protection to reduce the incentive for extortion. The continued upward trend in ransomware volumes signals an urgent need for organizations to reassess their security postures and invest in preventive measures. The widespread and lasting impact of these attacks demonstrates that ransomware remains one of the most significant threats to global business continuity and data security. Organizations are urged to prioritize anti-data exfiltration technologies and comprehensive incident response planning. The evolving threat landscape requires constant vigilance and adaptation to new attacker tactics. The experiences of both large enterprises and small businesses illustrate the far-reaching consequences of ransomware, from operational shutdowns to personal financial ruin. As attackers become more aggressive and sophisticated, the imperative for proactive defense and resilience has never been greater.
Jun 29, 2026
Manufacturers have become the primary target for cyberattacks in 2025, with over half experiencing ransomware incidents and paying significant ransoms, according to industry data. The average ransom payment reached $1 million, and recovery costs excluding ransom approached $1.3 million, highlighting the severe financial impact on the sector. The most common root cause of compromises shifted to exploited vulnerabilities, overtaking malicious emails and compromised credentials from previous years. Experts attribute the sector's vulnerability to a lack of security expertise, unaddressed cybersecurity gaps, and insufficient adoption of protective measures, making operational disruptions both likely and costly. The broader threat landscape in November 2025 was marked by a surge in data theft and ransomware attacks across multiple industries, with high-profile victims including major airlines, media organizations, universities, and healthcare providers. The Cl0p ransomware syndicate alone claimed responsibility for attacks on over 29 organizations, contributing to a global trend of increasing data breaches and extortion. Regulatory and legal pressures are intensifying, raising the stakes for organizations that fail to protect sensitive data. These developments underscore the urgent need for improved cybersecurity maturity, regular incident response testing, and proactive vulnerability management to mitigate the growing risks.
Jun 29, 2026