The new annual report from the GuidePoint Research & Intelligence Team (GRIT) is here. Data from the GRIT 2026 Ransomware & Cyber Threat Report confirms that ransomware operators consistently attack sectors where operational disruption creates heavy pressure to pay the ransom. GRIT’s victim and threat group tracking highlights clear concentrations of activity against specific industries throughout 2025. Read on for key insights, or get the full report now.
The manufacturing industry had the most ransomware victims in terms of volume, accounting for 1,060 victims (14%) of all observed ransomware victims. Manufacturing remains a constant “most impacted” presence, with increases both in real and relative terms year-over-year (YoY).
The five most impacted industries by volume remained consistent in 2025 and 2024:
Common among these industries is that they will more likely experience significant financial or operational losses from ransomware’s impacts on networks and to hold high-value or particularly sensitive data, such as Personally Identifiable Information (PII) and Protected Health Information (PHI). Which means they’re motivated to settle the issue.
Ransomware group Akira claimed responsibility for the highest number of observed victims against four of the five top industries. The exception is healthcare, which was disproportionately impacted by Qilin, another ransomware group.
GRIT also noted disparities in healthcare attacks by other groups. Some Ransomware-as-a-Service groups seem to prohibit or discourage attacks against healthcare organizations, perhaps because it may also extract a human toll.
GRIT observed a notable surge in the legal industry with more law firms and attorneys’ offices becoming public victims. Legal industry ransomware victims more than doubled YoY from 196 in 2024 to 455 in 2025, representing a 132% YoY increase.
Legal victims often preside over a veritable treasure trove of sensitive data, including client PII and PHI, and information protected under attorney-client privilege, increasing ransomware actors’ interest and coercive leverage.
For a deeper breakdown of industry impacts, geographic trends and defensive guidance, read the full GRIT 2026 Ransomware and Cyber Threat Report.