Three-quarters of Ransomware Attacks Target Mid-Market Firms

Nearly three-quarters of ransomware victims since 2023 were mid-sized organizations with $10m to $1bn in revenue, according to a new Black Kite study.

The third-party risk specialist analyzed 13,336 disclosed incidents dating back to January 2023, as well as a separate security scan of 120,128 mid-market companies, to compile its new report, Mid-Market Is the Routing Target.

Published on August 18, it follows the Dun & Bradstreet revenue-based definition for market size: lower mid-market at $10m-$50m, core mid-market at $50m-$500m and upper mid-market at $500m-$1bn.

The report found that 73% of ransomware attacks in North America and Europe hit companies with $10m-$1bn in annual revenue, with the figure barely moving even as the volume of incidents grew by 44% between 2023 and 2025.

Read more on ransomware: Verizon DBIR: Small Businesses Bearing the Brunt of Ransomware Attacks

Over the reporting period, the largest share of mid-market victims sat in the lower mid-market category (54%). In absolute terms, victim numbers rose here from 1391 in 2024 to 1821 in 2025.

The core mid-market accounted for the second-highest number of victims over the period, ranging from 40-45% across the three-and-a-half years.

Victim count here rose from 970 to 1474 between 2024 and 2025, while in the upper mid-market category, the numbers dropped from 126 in 2023 to 45 in 2025, a decline of 65%.

North America (72%) accounted for many more incidents than Europe (28%), where UK firms were the most popular target.

Gaps in Security Posture

Manufacturing firms were by far the most popular target for threat actors, accounting for 26% of mid-market ransomware victims, followed by professional, scientific and technical services, and construction sectors.

Manufacturing businesses typically have a low tolerance for outages and hold highly sensitive information, making them an attractive target.

Data released by industry body Make UK published in August revealed that almost a third of UK manufacturers (30%) experienced a cyber incident over the past year, either directly or through their supply chain. 

Separate data from ESET published in April found that, of UK manufacturers that suffered a cyber incident last year, almost all (95%) admit the attack had a direct impact on their business, and most (53%) suffered financial loss as a result.

Supply chain disruption (44%) and missed customer or supplier commitments (39%) were also commonplace.

Black Kite’s analysis of security posture across over 120,000 mid-market firms revealed some of the deficiencies which could lead to ransomware compromise. Its findings include:

• Over a quarter (28%) had at least one known exploited vulnerability (KEV)
• Over half (55%) had at least one significant patch management finding on public-facing software
• Nearly half (48%) carried at least one disclosed vulnerability with a CVSS score of 8.0 or higher
• Nearly a third (32%) had at least one stealer log finding
• Nearly half (47%) had missing or insufficient DMARC protection

The challenge for security teams in these organizations is set to increase as AI adoption grows, Black Kite argued.

“AI is accelerating how fast new vulnerabilities are discovered, and the volume is climbing toward levels no small team can triage by hand,” the report claimed. “Only a fraction of those vulnerabilities are ever exploited, but finding that fraction across a company’s own systems and its suppliers is exactly the work a mid-market team has little capacity to do.”