Manufacturing and Financial Services Lead Cyber Incidents; Ransomware Now Touches Nearly Half of All Breaches

Summary

Based on the Verizon 2026 Data Breach Investigations Report (DBIR) -- the most comprehensive multi-contributor incident dataset published -- Financial and Insurance, Public Administration, Manufacturing, and Professional Services generated the most reported security incidents in the latest 12-month window (Nov 2024-Oct 2025), each with well over 3,500 incidents. When the measure is narrowed to confirmed data breaches (not just incidents) or to ransomware-specific leak-site tracking, Manufacturing moves to the top spot, a pattern independently confirmed by three separate sources (Verizon DBIR, GuidePoint GRIT, and Black Kite/Help Net Security). On the second half of the question: ransomware's share of breaches has been rising for years and hit a new high in 2026 -- 48% of all confirmed breaches involved ransomware, up from 44% the year before, roughly 32% in 2024, and about 10% in 2021. The rate of increase slowed in the latest year (+4 points vs. +12 points the prior year), and the total number of ransomware victims disclosed publicly also kept climbing (Black Kite counted 7,551 in the 2025-2026 period, up 24.9% year-over-year), so the trend is rising, not plateauing or reversing.

Which industries lead on incident volume

The Verizon DBIR classifies victim organizations by NAICS 2-digit code and tracks over 31,000 security incidents and 22,000+ confirmed breaches globally for its 2026 edition (dataset window: November 2024-October 2025). Ranked by raw incident count:

Note the inversion: Financial & Insurance reports the most raw incidents but a comparatively low confirmed-breach rate (34%), largely because many financial-sector incidents are attempted intrusions, fraud attempts, or denial-of-service events that don't result in confirmed data disclosure. Manufacturing and Professional Services, by contrast, convert a much higher share of incidents into confirmed breaches (75% and 71% respectively) -- consistent with ransomware-heavy attack patterns, where the incident itself typically is the breach.

Two independent ransomware-specific trackers, which count publicly claimed leak-site victims rather than DBIR-style incident reports, both put Manufacturing unambiguously in first place: GuidePoint's GRIT 2026 report counted 1,060 manufacturing ransomware victims (14% of all tracked victims) for 2025, and Black Kite counted 1,660 manufacturing victims (22% of all disclosures) for its April 2025-March 2026 window -- the fourth consecutive year manufacturing has led (independently corroborated in Help Net Security's coverage of the same Black Kite report). Both trackers place Professional/Technical Services, Healthcare, and Retail/Wholesale in the next tier, and both flag a sharp 2025 surge in ransomware attacks on the Legal industry (up 132% year-over-year, from 196 to 455 victims per GRIT).

Is ransomware's share of incidents rising or falling

Rising, consistently, across every year Verizon has published a comparable figure:

The 2026 DBIR states this plainly: "Ransomware grew again to 48% of all breaches, up from 44% from the previous year." One nuance worth flagging: the growth rate itself decelerated (a 12-point jump from 2024 to 2025, but only a 4-point jump from 2025 to 2026), and the median ransom actually paid continues to fall ($139,875 in 2026 vs. $150,000 in 2025), with 69% of ransomware victims now refusing to pay at all. So the story is not simply "ransomware is exploding" -- it is closer to "ransomware now touches roughly half of all breaches, growth is slowing at the margin, but attackers are extracting less money per successful hit while volume keeps climbing." Corroborating this from the attacker-volume side rather than the victim-breach side, Black Kite counted 7,551 publicly disclosed ransomware victims in its April 2025-March 2026 window, a 24.9% year-over-year increase and the fourth consecutive year of record disclosures -- with disclosures accelerating 60% in the second half of the period versus the first -- and the number of active ransomware groups roughly doubling from 61 (2023) to 146 (June 2026), meaning more competing actors are entering the market, not fewer.

A note on data coverage

The AskAmerica connector's cybersecurity schemas (cyber_vuln, cyber_threat) were checked directly for this question via search_catalog and list_tables. They cover NVD/CISA vulnerability catalogs, MITRE ATT&CK, NIST controls, and open threat-intelligence indicator feeds (malware hashes, malicious URLs, botnet IPs) -- valuable for vulnerability and indicator-of-compromise research, but they do not carry incident- or breach-volume statistics by industry, nor a ransomware share-of-incidents time series. That is a genuine sourcing gap in this corpus rather than something this report worked around with a weaker proxy; the entire industry-and-trend analysis above comes from primary published industry reports (Verizon DBIR, GuidePoint GRIT, Black Kite/Help Net Security) rather than from the connector's own tables.