Nearly three-quarters of ransomware attacks since 2023 have targeted mid-market organisations, new research finds.
According to Black Kite, this highlights the growing pressure on companies with revenues between $10 million and $1 billion
The report
The findings from Black Kite’s recent study, examined 13,336 disclosed cyber-incidents dating back to January 2023 and assessed the security posture of 120,128 mid-market firms.
The report found that incident volumes grew by 44% between 2023 and 2025, showing just how quickly mid‑market organisations are being targeted.
Across North America and Europe, 73% of ransomware victims fall within the mid-market bracket.
The company explained that North America accounted for 72% of the incidents, compared to Europe (28%), where UK firms were the most popular target.
Lower mid-market companies were hit the hardest, making up 54% of victims.
Core mid-market firms represented 40-45% of cases, accounting for the second highest number of victims.
While in the upper mid-market category, the numbers dropped from 126 in 2023 to 45 in 2025, a decline of 65%.
Manufacturing firms were the most frequently targeted sector, accounting for 26% of mid-market victims, followed by professional, scientific and technical services and construction sectors.
“The most appropriate cybersecurity products”
Simon Edwards, CEO of SE Labs, commented: “Mid-sized businesses are typically less able to defend themselves, which makes them more attractive targets than large organisations for ransomware gangs.”
“It’s crucial that businesses of all sizes have a cyber-defence plan in place before a major attack happens, and that plan should include choosing the most appropriate cybersecurity products for their organisation.
“That should be informed by independent test reports that help businesses make informed buying decisions both when identifying breaches and protecting themselves against these threats.”
Exploitation
The report warns that the challenge for mid-market security teams is set to intensify as AI accelerates the discovery of new vulnerabilities.
The volume of issues now exceeds what small teams can realistically work through, leaving organisations to identify which weaknesses are most likely to be exploited.
Click Here For The Original Source.
