Ransomware Attacks Surge 55% Across Europe in Early 2026, Black Kite Report Finds A new report from cyber risk management firm Black Kite reveals a sharp rise in ransomware attacks targeting European organizations, with incidents increasing by 55.1% year-over-year in the first four months of 2026. The analysis, based on publicly disclosed incidents, recorded an average of 171 attacks per month, as detailed in the company’s 2026 European Cyber Risk Report, published on June 25. Five countries bore the brunt of the attacks, accounting for 70% of all incidents: Germany (18%), the UK (17%), France (12%), Italy (12%), and Spain (10%). The Qilin ransomware emerged as the most prolific strain, responsible for 372 recorded attacks across 26 of the 31 countries analyzed more than double the next most common variant, Akira (159 incidents). SafePay ransomware, however, showed a targeted focus on Germany, particularly in industrial hubs like the Ruhr Valley and Bavaria, where manufacturing firms were heavily impacted. Manufacturing was the hardest-hit sector, representing 28% of all ransomware incidents in Europe. The report highlighted the Jaguar Land Rover (JLR) attack in 2025 as a case study in the far-reaching consequences of such breaches, which forced 30,000 employees to reset passwords and became the costliest cyber incident in UK history. Black Kite’s Chief Research and Intelligence Officer, Dr. Ferhat Dikbiyik, attributed the surge to three converging factors: accelerating ransomware activity, supply chain vulnerabilities, and stricter regulatory scrutiny on third-party risk. The report noted that over 30 ransomware incidents were linked to the August 2025 compromise of Swedish software supplier Miljödata, underscoring how cybercriminals increasingly exploit supply chain weaknesses to amplify their impact. The findings emphasize that downstream effects where a single breach cascades through interconnected networks are now a defining feature of major ransomware campaigns. Researchers stressed the need for organizations to map risk concentration and monitor threat propagation to build resilience.