UK factories face surge in ransomware attacks, SonicWall report shows

Threat intelligence from SonicWall indicates that the United Kingdom’s manufacturing sector has become the nation’s primary battlefield for ransomware. Monitoring of 364 specialised sensors in UK factories between January and May 2026 recorded 15.8 million intrusion‑prevention events and 12.2 million malware threats.

The data shows 1.84 million ransomware incidents in just five months – about 28 % higher than the full‑year total for 2025 – with the majority linked to the Filecoder ransomware family (1.79 million hits focused on two sensors). Attackers are targeting operational technology such as SCADA, MES and ERP systems, exploiting vulnerabilities like Apache Log4j (1.1 million hits on 34 % of sensors) and React Server Components RCE (detected on 45 % of sensors).

SonicWall’s executive vice‑president for EMEA, Spencer Starkey, warned that “factory floors are prime extortion targets, where downtime means lost revenue and supply‑chain chaos.” The concentration of attacks suggests dedicated campaigns aimed at halting high‑value production lines rather than broad, scatter‑shot activity.