Black Kite report finds 73% of ransomware incidents hit mid-market companies

Black Kite has published a report showing that mid-market companies bore the brunt of ransomware attacks between January 2023 and June 2026. The analysis of 13,336 incidents across North America and Europe found that 73% hit firms with annual revenues between $10 million and $1 billion, a share that held steady at roughly 72% to 75% each year even as the total number of incidents grew by 44%.

Manufacturing was the most targeted sector, accounting for more than a quarter of mid-market victims, followed by professional, scientific and technical services and construction. The report also found that 28.3% of mid-market organisations had at least one known exploited vulnerability, 54.7% had significant patch management findings, and 46.8% lacked sufficient DMARC protection.

Black Kite said mid-market firms face growing pressure from third-party risk and regulation such as the EU’s NIS2 Directive and US rules like NYCRR 500 and HIPAA, while AI is widening the gap: only 20% of mid-sized organisations have adopted AI for security, according to ISC2’s 2025 workforce study.