Dragos publishes Q1 2026 industrial ransomware analysis report

Ransomware remained a persistent and disruptive threat to industrial organizations into the first quarter of 2026. Dragos identified 1,020 ransomware incidents impacting industrial organizations worldwide through analysis of publicly disclosed victim data and ransomware groups postings on data leak sites. Manufacturing, transportation, industrial control system equipment manufacturers, and engineering firms represented the most affected sectors. North America continued to account for the majority of incidents with nearly 500 reported victim organizations. Europe remained the second most affected region with more than 250 incidents. North America and Europe collectively accounted for more than half of all observed victims. Manufacturing accounted for 62 percent of all observed industrial ransomware victims and 633 incidents across all subsectors. Construction related manufacturing, industrial equipment producers, and food and beverage manufacturers were particularly affected. ICS adjacent organizations including engineering firms, system integrators, and equipment suppliers accounted for 139 incidents. No ransomware variants specifically engineered to manipulate industrial control protocols or process environments were observed during the quarter. Ransomware incidents continued to produce substantial operational consequences through the loss of IT systems, enterprise resource planning platforms, and virtualization infrastructure. The continued convergence of IT and OT environments further amplified the impact. Ransomware groups continued to rely on well established tactics, techniques, and procedures including credential theft, abuse of valid accounts, exploitation of remote access services, lateral movement via common enterprise protocols, and double extortion models. Qilin and Akira accounted for the highest volume of ransomware claims against industrial organizations. The Gentleman operation accounted for 83 incidents in the first quarter, a sharp increase from 18 in Q4 2025.