Ransomware attackers are zeroing in on mid-market companies

A Black Kite analysis of 13,336 publicly disclosed ransomware and data-extortion incidents (Jan 2023–Jun 2026) shows mid-market companies (annual revenue $10M–$1B) made up 73% of victims, with smaller mid-market firms ($10M–$50M) most often targeted. The report highlights common attack enablers—unpatched public-facing systems (54.7% affected), vulnerabilities known to be exploited, and stolen credentials (≈33% with stealer-log findings)—and stresses growing pressure from AI-driven discovery, constrained security teams, and supply-chain/interconnected third-party risks that amplify exposure.