Ransomware Surge Targets Manufacturers and Amplifies Supply-Chain Disruption

Manufacturing accounted for 22% of publicly disclosed ransomware victims from April 2025 through March 2026, retaining its position as the most-targeted sector for a fifth consecutive year. Recorded incidents rose about 40% year over year to 1,183 in the first seven months of 2026, with European victims increasing 85.4% and Germany facing particular pressure. Attackers target manufacturers because production stoppages, delayed deliveries, and supply-chain disruption increase leverage in extortion negotiations; the Jaguar Land Rover incident and Clop’s exploitation of Cleo illustrate the potentially broad downstream impact.

New and established ransomware-as-a-service operations are driving the increase. Qilin claimed the most victims during the reporting period, while SafePay focused heavily on German manufacturers and The Gentlemen expanded rapidly; in Japan, The Gentlemen led observed activity with 14 of 90 ransomware incidents from January through July, where manufacturing was also the most affected sector and 78% of victims were small and medium-sized organizations. Talos identified The Gentlemen infrastructure consistent with reconnaissance, Active Directory compromise, credential theft, lateral movement, backup theft, and exfiltration to Wasabi cloud storage, while Qilin-linked endpoint-wiping and Veeam-backup destruction scripts showed signs of likely LLM-assisted development.