Ransomware Attacks on Industrial Organizations Surge 12% in Q2 2026, Dragos Reports

A recent analysis by industrial cybersecurity firm Dragos reveals a significant 12% increase in ransomware incidents impacting industrial organizations during the second quarter of 2026, totaling 1,140 attacks globally. This upward trend underscores the persistent and evolving threat ransomware poses to critical infrastructure sectors. The report emphasizes a crucial shift in attacker tactics: while direct manipulation of industrial control systems (ICS) remains rare, ransomware operators are increasingly targeting enterprise IT systems that underpin operational technology (OT) environments. Disrupting these interconnected IT systems—such as ERP platforms, virtualization infrastructure, identity services, and remote access gateways—can effectively cascade into production shutdowns, operational downtime, and supply chain disruptions, even without gaining direct access to the core ICS. Manufacturing continues to be the most heavily affected sector, accounting for 65% of all incidents with 747 reported attacks. Other significantly impacted sectors include ICS-related organizations like engineering firms and equipment manufacturers, and transportation and logistics. North America and Europe experienced the highest concentration of these attacks. Dragos's findings highlight that the extortion model is increasingly shifting from data encryption towards data theft-only operations, where stolen employee, customer, or operational data is leveraged for further extortion or publication. To mitigate these risks, Dragos advises organizations to prioritize reducing their attack surface, accelerating patching processes, strengthening identity and access controls, and preparing for inevitable incidents.