Who Gets Hit
It's Not a Coincidence
Three in Four Victims Are Mid-Market
Black Kite’s analysis of 13,336 ransomware incidents with verifiable revenue across North America and Europe (from January 2023 to June 2026) shows that 73% of those incidents struck mid-market organizations with annual revenues between $10 million and $1 billion.
This concentration has proven highly consistent over time.
The mid-market share of incidents with verifiable revenue has remained remarkably steady over time: 74.6% in 2023, 72.1% in 2024, 74.0% in 2025, and 72.3% during the first half of 2026.
Even as the absolute number of incidents grew by 44%, surging from 2,320 in 2023 to 3,340 in 2025, the proportion of mid-market targets held firm.
Evaluating the data on a half-year basis makes this trajectory even clearer. Mid-market victim counts during the first six months of each year reveal a resilient and expanding threat.
After the minor dip in 2024, first-half victim counts surged by 50% year-over-year in 2025, and the first half of 2026 shows the elevated level holding rather than retreating. Attack volume has established a new, highly elevated baseline.
This sustained pace is further illustrated by the quarterly data.Three of the four most active quarters on record occurred during this recent surge, with the first quarters of both 2025 and 2026 each approaching 1,000 mid-market victims.
That consistency is the point: The mid-market isn't an occasional target caught in the crossfire of a bad year. It's the segment ransomware operators return to, year after year.
Half of Mid-Market Victims Earn Under $50 Million
While mid-market companies bear the brunt of ransomware activity, this burden is not distributed equally across the sector. Analyzing these organizations by revenue reveals a concentration of victims, divided into three key segments: The lower, core, and upper mid-market.
Lower Mid-Market ($10M – $50M)
This segment consistently represents the absolute majority of all mid-market ransomware victims.
- Lower mid-market companies accounted for 50.5% of victims in 2023, peaking at 57.2% in 2024, before stabilizing at 54.5% in 2025 and 53.5% in the first half of 2026.
- In absolute terms, attack volume here grew rapidly, rising from 1,391 victims in 2024 to 1,821 in 2025.
The 2024 plateau in total mid-market victims conceals two opposite movements. Measured in absolute counts, the year that law enforcement operations disrupted LockBit and Clop saw victim numbers fall in the two larger bands, with core mid-market declining from 1,023 to 970 and the upper band from 126 to 70. Lower mid-market moved the other way. Victims in the $10 million to $50 million range grew from 1,171 to 1,391 in the same year, an increase of 18.8%, straight through the most disruptive period the ransomware ecosystem has faced in the window.
The slowdown, in other words, was concentrated at the larger end of the mid-market while attacks on its smallest companies never paused.
Core Mid-Market ($50M – $500M)
Representing the second-largest concentration, this segment absorbs most of the remaining target share.
- The core band maintained a highly consistent share of roughly 40% to 45% throughout the entire three-and-a-half-year window.
- Similar to the lower band, absolute victim numbers in the core segment jumped significantly, climbing from 970 in 2024 to 1,474 in 2025.
Upper Mid-Market ($500M – $1B)
The upper band moved more steeply than any other part of the distribution, in the opposite direction.
Tracked victims with revenues between $500 million and $1 billion fell from 126 in 2023 to 70 in 2024 and 45 in 2025, a decline of 64% over two years.
The first half of 2026 recorded 29 victims; because this figure covers six months, it cannot be set against full-year counts, and against the same period a year earlier (21 victims in the first half of 2025) it marks a small increase from a very low base rather than a continued fall.
North America Holds the Volume, Europe Holds the Momentum
The geographic distribution of mid-market ransomware victims has been heavily weighted toward North America across the window. Of 9,781 mid-market incidents, 7,079 (72.4%) are North American and 2,702 (27.6%) are European.
The concentration was built during the years of rapid ransomware expansion.
Between 2023 and 2025, North American mid-market victims rose from 1,568 to 2,582, an increase of 64.7%. European counts over the same period moved from 752 to 758, effectively flat. The surge that redefined the mid-market threat level in 2025 was, in the data, almost entirely a North American event.
The first half of 2026 reverses that pattern. European mid-market victims reached 545 in the first six months, compared with 370 in the same period of 2025, a 47.3% increase. North American counts moved in the opposite direction, declining from 1,283 to 1,145, down 10.8%. In one half-year, Europe recorded 72% of its entire 2025 victim total.
Across the full window, mid-market ransomware victims concentrate in a small number of countries.
The United States accounts for 6,486 of 9,781 victims.
The next six markets are
The United Kingdom
Canada
Germany
France
Italy
Spain
Together these seven countries account for 91% of all mid-market victims in the dataset.
Manufacturing Carries a Quarter of Mid-Market Ransomware Victims
Manufacturing accounts for more mid-market victims than the next two sectors combined, with 2,521 of 9,781 mid-market ransomware victims, or 25.8% of the total.
The sectors that follow:
- Professional, Scientific, and Technical Services (1,453)
- Construction (671)
- Health Care and Social Assistance (620)
- Wholesale Trade (540)
- Information (531)
- Educational Services (525)
Manufacturing has also been gaining ground. Its victim count rose from 480 in 2023 to 934 in 2025, and its share of mid-market victims widened from 20.7% to 28.0% over the same period, holding at 27.0% through the first half of 2026. The half-year pattern matches the wider trend: 240 victims in each half of 2023, rising to 468 in the first half of 2025, and holding at 456 in the first half of 2026.
Sector fortunes have diverged more than the overall figures suggest. Comparing the first half of 2026 with the first half of 2023, against 41.4% growth in mid-market victims overall, the picture splits:
Construction victim counts rose 141.7%, from 60 to 145, and Information rose 88.5%.
Two sectors moved against the trend: Health Care and Social Assistance declined 2.4% while the overall figure grew by more than 40%, cutting its share from 7.1% to 4.9%.
Educational Services declined 38.7%, from 93 victims to 57, and its share fell from 7.8% to 3.4%, the only sustained decline of the window.
Next: 928 attacks from one group alone.
Ransomware operators rotate constantly, but what they find when they look at you doesn't change.