Ransomware · Threat Intelligence
Ransomware Attacks on Manufacturers Surge, Disrupting Supply Chains Across Europe and US
Ransomware attacks on manufacturers rose 40% in early 2026, with major impacts on supply chains and economies, particularly in Europe and the US.
Ross GrantUpdated 3 min read
The short version
Ransomware attacks are rising fast among manufacturers. These attacks stop factories from working until a ransom is paid, causing big problems for supply chains and economies. Major companies like Jaguar Land Rover have had to shut down production, leading to job losses and huge financial damage. Europe is now seeing more of these attacks than ever before.
By the numbers
- 40%increase in ransomware attacks on manufacturers in early 2026SecurityWeek
- £1.9 billionestimated financial impact of Jaguar Land Rover attackSecurityWeek
- 4,000Jaguar Land Rover jobs cut after attackSecurityWeek
- 1,183new manufacturing ransomware incidents in first 7 months of 2026SecurityWeek
- 85%increase in European manufacturing ransomware attacksSecurityWeek
- 5,237disclosed ransomware victims in manufacturing and distribution (Jan 2023–Jul 2026)SecurityWeek
What happened?
Ransomware attacks on manufacturers rose 40% in early 2026 compared to the same period in 2025, according to SecurityWeek. Major incidents included a shutdown at Jaguar Land Rover, which led to £1.9 billion in losses and thousands of job cuts. Europe saw an 85% increase in attacks, with Germany, Italy, the UK, and France most affected.
Ransomware Hits Manufacturing Harder Than Ever
Ransomware attacks on manufacturers have surged by 40% in the first seven months of 2026 compared to the same period in 2025, according to research cited by SecurityWeek (opens in a new tab). The manufacturing sector remains a prime target because a single attack can halt production lines, disrupt deliveries, and cause ripple effects up and down the supply chain. This makes manufacturers especially vulnerable to extortion.
The Jaguar Land Rover Incident: A Case Study in Impact
In September 2025, Jaguar Land Rover was forced to shut down its UK plants after a ransomware attack, stopping the daily production of about 1,000 vehicles. The shutdown affected over 5,000 other companies and was cited by the Bank of England as a factor in slowing national economic growth. The company later announced 4,000 job cuts, directly blaming the cyberattack. The UK’s Cyber Monitoring Centre estimated the financial impact at £1.9 billion, calling it the most economically damaging cyberattack in UK history, even surpassing the 2017 WannaCry outbreak.
Why Manufacturing is a Target
According to the 2026 Black Kite Manufacturing & Distribution Ransomware Report, attackers focus on manufacturers because of the immediate operational impact. When production stops, every hour of downtime increases the pressure on companies to pay a ransom. Attackers use reconnaissance to find weak points, such as unpatched systems, exposed services, leaked credentials, or misconfigured defences. Mid-sized manufacturers, often suppliers to larger firms, are especially at risk. Attacks on these suppliers can quickly disrupt the operations of much larger companies.
Who is Behind the Attacks?
The number of ransomware groups is rising. Half of the attacks in 2026 were carried out by groups that did not exist two years ago. One new group, The Gentlemen, was responsible for 12% of this year’s attacks and had claimed 142 manufacturing victims by mid-2026. Other major groups include Qilin, Akira, DragonForce, and INC Ransom. The SafePay group was particularly active in Germany, responsible for 22% of attacks there in 2025 and remaining a major threat in 2026.
Europe in the Crosshairs
While the US still saw the most attacks (412 incidents in early 2026), Europe experienced the fastest growth, with an 85% increase in attacks compared to last year. Germany was hit hardest, with 77 attacks, followed by Italy (57), the UK (43), and France (40). Attacks outside Europe and the US almost doubled to 402 incidents.
Distribution Sector Also at Risk
The distribution sector, which includes trucking, freight, and warehouse companies, is also being targeted. These businesses are key nodes in the supply chain, and attacks on them can disrupt the movement of goods for many companies at once.
What Should Companies Do?
Manufacturers and their suppliers need to focus on basic cyber hygiene: patching systems, securing exposed services, and monitoring for leaked credentials. Supply chain risk assessments and incident response planning are now essential. Companies should also review their vendor lists and ensure that partners are following strong security practices.
What Happens Next?
The surge in attacks and the growing number of ransomware groups suggest that manufacturing and distribution will remain high-value targets. With the economic impact now proven, governments and industry groups may increase pressure for better security standards and reporting. For now, the risk remains high, and the consequences can be severe.
Claimed vs confirmed
- Unconfirmed
Ransomware attacks on manufacturers rose 40% in early 2026.
Reported by SecurityWeek citing Black Kite, but not yet confirmed by primary sources.
- Unconfirmed
Jaguar Land Rover's shutdown caused £1.9 billion in losses and 4,000 job cuts.
Reported by SecurityWeek; not yet confirmed by Jaguar Land Rover or UK authorities.
- Unconfirmed
Half of 2026 attacks were carried out by groups that did not exist two years ago.
Reported by SecurityWeek citing Black Kite.
The impact
- Money
- The Jaguar Land Rover attack alone caused an estimated £1.9 billion in losses. UK GDPR fines can reach up to £17.5 million or 4% of global turnover, but no fine has been reported yet.
- Reputation
- Major manufacturers face reputational damage and loss of trust, especially when attacks lead to production halts and job cuts. The visibility of these incidents is high, with national economic impact.
- Customers
- Customers may face delays in receiving products, higher prices, or cancelled orders. Businesses should check their supply chain partners' security and prepare for possible disruptions.
Why it matters
Manufacturers are key to the supply chain. When they are hit by ransomware, it can stop production, delay deliveries, and cause job losses. This affects not just the companies themselves, but also their suppliers, customers, and even national economies.
How does it work?
Ransomware is a type of malware that encrypts files or systems, making them unusable until a ransom is paid. Attackers often target manufacturers because shutting down production lines causes immediate and severe disruption, increasing the pressure to pay. They look for weaknesses such as unpatched systems, exposed services, leaked credentials, or misconfigured defences.
Key points
- Ransomware attacks on manufacturers rose 40% in early 2026.
- Jaguar Land Rover's shutdown led to £1.9 billion in losses and 4,000 job cuts.
- Europe saw an 85% increase in manufacturing ransomware attacks.
- Half of the ransomware groups active in 2026 did not exist two years ago.
- Supply chain disruption is a major consequence of these attacks.
Sources
SecurityWeek
Reference
