Global ransomware attacks on industrial systems

In mid-2026, reports indicated a significant rise in ransomware activity targeting industrial and manufacturing sectors. In the United Kingdom, data from SonicWall showed that the manufacturing sector became a primary target, with 1.84 million ransomware incidents recorded between January and May 2026. These attacks frequently utilized the Filecoder ransomware family and targeted operational technology, including SCADA and ERP systems, by exploiting vulnerabilities such as Apache Log4j.

Globally, Kaspersky ICS CERT reported a similar trend during the second quarter of 2026, noting an increase in the proportion of Industrial Control Systems (ICS) computers targeted by ransomware. While the rate of blocked malicious objects reached its lowest level since 2022, the targeting of ICS computers rose sharply in regions including Australia, New Zealand, Southeast Asia, South America, Africa, Central Asia, and the Middle East. Experts warned that attackers are increasingly using legitimate management tools to evade detection, posing risks of physical disruption and supply-chain paralysis.