Mid-market firms targeted in 73% of ransomware attacks

New research from Black Kite indicates that mid-market organizations, defined as those with annual revenues between $10 million and $1 billion, have become the primary targets for ransomware. Between 2023 and the first half of 2026, approximately 73% of ransomware attacks in North America and Europe targeted this sector.

In North America, 72% of incidents occurred within the mid-market, while Europe accounted for 28%, with the UK being a frequent target. The manufacturing sector was the most affected, representing 26% of mid-market victims, followed by the construction and professional services sectors. The study notes that incident volumes grew by 44% between 2023 and 2025.

Experts suggest mid-market firms are targeted because they often lack the robust security operations centers and segmented network architectures found in larger enterprises. Additionally, the Cl0p ransomware group has been identified as conducting a campaign exploiting vulnerabilities in the PTC Windchill product lifecycle management platform.