Skip to content
Global Industrial Ransomware Incidents Surge 12% in Q2 2026

Global Industrial Ransomware Incidents Surge 12% in Q2 2026

First seen 18 Aug 2026, 04:06 UTC • •

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •August 19, 2026 at 03:02 UTC

Ransomware attacks on industrial organizations increased by 12% globally in Q2 2026, with Dragos reporting 1,140 incidents, up from 1,020 in Q1. Manufacturing was the most affected sector, accounting for 65% of incidents. Australia and New Zealand reported 19 incidents, unchanged from Q1, highlighting significant exposure in a sector employing over a million people. The ransomware group The Gentlemen claimed responsibility for an attack on Mackay Sugar, which disrupted operations at two mills. Dragos noted that no direct manipulation of industrial control systems was observed, as disruptions typically followed the encryption of IT systems. The insurance market is under pressure as many businesses remain uninsured, with critical distinctions in policy coverage for operational technology disruptions. The report identified major ransomware actors, including Qilin, Akira, and The Gentlemen, responsible for a significant portion of the tracked activity.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 54d ago How this analysis works

Timeline

2026-06-10
Mackay Sugar cyber incident
A ransomware attack forced two of Mackay Sugar's mills to halt operations, impacting production during the crushing season.
Insurancebusinessonline.Au
2026-08-17
Q2 2026 ransomware report released
Dragos published data showing 1,140 ransomware incidents in Q2 2026, marking a 12% increase from Q1.
Insurancebusinessonline.Au
2026-08-17
Insurance market pressure noted
The report highlighted a growing gap in cyber insurance coverage as industrial organizations face increasing ransomware threats.
Insurancebusinessmag

More articles in this cluster (2)

Following this threat?

Track Akira and Mackay Sugar in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed