Key Takeaways
- Mid‑market firms (annual revenue $10 M–$1 B) suffered about three‑quarters of all ransomware incidents recorded between 2023 and mid‑2026.
- Manufacturing was the most‑targeted industry, accounting for >25 % of victims, with professional services, construction, and wholesale also heavily affected.
- Nearly 30 % of mid‑market organizations had at least one known exploited vulnerability during the study period.
- Ransomware attacks were concentrated in the smallest revenue band ($10 M–$50 M), which represented roughly half of all incidents; the “core mid‑market” ($50 M–$500 M) contributed 40‑45 %, while the upper tier ($500 M–$1 B) saw a steep decline.
- Supply‑chain exposure magnifies damage: a breach at a mid‑market supplier can cascade to its customers, prompting large firms to demand detailed security questionnaires.
- Vendor‑risk teams at mid‑market companies are typically staffed by two or fewer people, yet must oversee portfolios of 300+ suppliers, making continuous manual oversight infeasible.
- Geographically, North America dominated the data set, with 72 % of attacks targeting U.S. and Canadian firms; European victim counts remained flat while North American incidents rose from 2023 to 2026.
- The report underscores a gap in cybersecurity focus: mid‑market firms receive less attention than small businesses or large enterprises, despite their pivotal role in interconnected supply chains.
Overview of Ransomware Trends (2023‑H1 2026)
Black Kite’s analysis of 13,336 ransomware incidents revealed that medium‑sized businesses—those with annual revenue between $10 million and $1 billion—accounted for roughly 73 % of all attacks. This disproportionate share highlights the mid‑market as a prime target for threat actors, who likely perceive these organizations as having valuable data but comparatively weaker defenses than larger enterprises. The steady volume of incidents over the multi‑year window suggests that ransomware groups have successfully adapted their tactics to exploit the specific operational and security gaps prevalent in this segment.
Defining the Mid‑Market Segment
For the purpose of the report, Black Kite classifies mid‑market firms as companies generating $10 million to $1 billion in yearly revenue. This bracket sits between the well‑studied small‑business sector (often hampered by limited resources) and the large‑corporate realm (which attracts intense media scrutiny when breached). By focusing on this intermediate group, the study sheds light on a cohort that frequently operates as both supplier and customer, a dual role that complicates risk management and blurs traditional boundaries between upstream and downstream security responsibilities.
Supply‑Chain Dynamics and Cascading Impact
The sectors most victimized—manufacturing, professional services, construction, and wholesale—are populated by firms that routinely provide goods or services to other businesses. When one of these companies suffers a ransomware attack, the disruption does not remain isolated; it can ripple outward to its customers and inward to its own suppliers. Black Kite notes that the incident is logged against the victim’s name, yet the downstream effects—production halts, delayed deliveries, and reputational harm—can affect numerous partners, amplifying the overall economic cost of a single breach.
Vendor‑Risk Management Challenges
Large customers increasingly require their mid‑market suppliers to demonstrate robust cybersecurity postures, prompting a surge in security questionnaires and compliance demands. However, many mid‑market organizations lack the staffing to meet these expectations. Industry surveys cited in the report reveal that vendor‑risk programs are often managed by teams of two or fewer individuals tasked with overseeing portfolios that exceed three hundred suppliers. This stark imbalance renders continuous, manual oversight impractical, leaving gaps that attackers can exploit through third‑party vectors.
Incident Distribution Across Revenue Tiers
Ransomware activity was not uniform across the mid‑market spectrum. The smallest tier—firms earning $10 million to $50 million—accounted for approximately half of all recorded incidents. The “core mid‑market” band ($50 million–$500 million) followed closely, contributing 40‑45 % of attacks. In stark contrast, the upper tier ($500 million–$1 billion) experienced a marked decline, with reported cases dropping from 126 in 2023 to just 45 in 2025, a 64 % reduction. This pattern suggests that threat actors may perceive the very largest mid‑market firms as having strengthened defenses, while the lower‑revenue segments remain attractive due to comparatively weaker security postures.
Geographic Concentration of Attacks
The data set, drawn from 120,128 mid‑market businesses in North America and Europe, showed a pronounced regional skew. Seventy‑two percent of ransomware victims were located in North America, and the number of attacks on U.S. and Canadian companies grew steadily from 2023 through mid‑2026. European victim counts, by contrast, remained essentially flat over the same period. This divergence may reflect differences in threat‑actor focus, regional regulatory environments, or varying levels of cybersecurity maturity across the two continents.
Known Vulnerabilities and Exploitability
Approximately 30 % of the mid‑market organizations examined possessed at least one known, exploitable vulnerability during the study window. These weaknesses—ranging from unpatched software to misconfigured services—provided attackers with reliable entry points for ransomware deployment. The prevalence of such vulnerabilities underscores the importance of basic hygiene measures, including timely patch management and configuration audits, which are often overlooked amid competing operational priorities in resource‑constrained mid‑market firms.
Implications for Large Enterprises and Regulatory Frameworks
Because mid‑market firms frequently serve as critical links in supply chains, large customers impose stringent security expectations, often codified by regulations in the United States and Europe that mandate supplier cybersecurity accountability. Black Kite’s report highlights examples of such rules, illustrating how compliance pressure cascades down the chain. Yet, the inability of many mid‑market companies to satisfy these demands creates a friction point: large enterprises face heightened risk from their suppliers, while suppliers struggle to allocate sufficient security talent and budget to meet external expectations.
Conclusion: Addressing the Mid‑Market Gap
The findings collectively reveal a paradox: mid‑market businesses are indispensable to the functioning of broader economic networks, yet they receive comparatively less cybersecurity attention than either small businesses or large corporations. Their dual role as supplier and customer, combined with thinly staffed risk‑management teams and a high prevalence of exploitable weaknesses, makes them attractive targets for ransomware actors. Closing this gap will require a multifaceted approach—enhanced automation for vendor risk assessments, increased investment in foundational security controls, and clearer regulatory guidance that recognizes the unique constraints faced by mid‑market enterprises. Only by strengthening the defenses of this pivotal segment can the overall resilience of global supply chains be meaningfully improved.