Ransomware surge in Europe puts suppliers under fire

Ransomware attacks in Europe have surged sharply, especially within large markets

Ransomware has become one of the fastest-growing cyber threats in Europe. According to Black Kite’s recent analysis, incidents rose by 55.1% year on year between January 2025 and April 2026, hitting an average of 171 attacks every month. That reflects the strategic nature of the threat. Attackers are focusing where the risk-to-reward ratio is highest: the continent’s biggest economies. Germany, the United Kingdom, France, Italy, and Spain together accounted for almost 70% of all reported cases.

Executives leading operations in these regions need to recognize that large-scale corporate ecosystems create broader entry points. More data, more suppliers, and more digital connections mean bigger targets. The cyber threat landscape is concentrating. Germany alone saw 370 ransomware incidents (17.9% of total), followed by the UK with 347 (16.8%), France at 255, Italy with 240, and Spain at 203. These numbers highlight a simple truth: Europe’s economic centers are the main battlegrounds for attackers seeking high-value disruptions.

This is about maintaining operational continuity. For business leaders, cybersecurity is now a pillar of strategic resilience. Companies that can quickly adapt their defenses, improve incident response speeds, and refine digital supply chain visibility will outperform those treating cybersecurity as an afterthought. The trend shows that advanced economies face higher risk not because they are weak, but because they are critical nodes in Europe’s digital network.

Supplier networks are emerging as a key vulnerability, serving as entry points for ransomware attacks

A single supplier’s weakness can become an industry-wide problem. Black Kite identified 64 European organizations that were hit indirectly through compromised third parties. Among these incidents, one stands out: the breach of Swedish software firm Miljödata. That attack spread across roughly 250 of its customers, including around 200 municipalities and regional authorities, exposing more than one million personal records. It’s a sharp reminder that when a supplier falls, disruption doesn’t stop at their firewall, it extends into every connected system.

For decision-makers, this highlights the urgent need to move beyond traditional security boundaries. Many organizations still evaluate cybersecurity as an internal issue. The data says otherwise. Attackers are expanding their focus to the links that connect companies. Manufacturing took the hardest hit, representing 27.9% of all ransomware incidents. Professional, scientific, and technical services followed at 17.8%, led by IT service providers who often sit at the center of large customer networks.

Business leaders should see supplier cyber risk not as an IT challenge but as a governance issue. Vendor vetting, data handling oversight, and shared security accountability need to become standard operating practice. C-suites should push for continuous monitoring of vendor cybersecurity status and formalize response coordination with suppliers. The message is simple: protecting your company now means protecting your network of partners too.

Ransomware has evolved into an ecosystem threat. That shift requires executives to think in terms of ecosystems. The companies that recognize this early, and act on it, will be the ones best positioned to maintain trust and stability in an environment where one weak node can impact hundreds.

Ransomware groups are deploying varied strategies across europe, tailoring their campaigns to regional dynamics

The data from Black Kite’s research shows that ransomware groups are not acting uniformly. Each one is applying distinct strategies shaped by geography, language, and industry structure. Qilin, Akira, and SafePay stood out as the most active. Qilin was the most pervasive, operating in 26 of the 31 European countries analyzed. Its scale shows the group’s capability to adapt operations to multiple national markets. SafePay, by contrast, directed more than half of its activity toward German organizations, demonstrating a focused approach optimized for a specific environment.

This difference matters. It shows that these groups understand their targets well. They adjust based on profitable sectors, the availability of vulnerable supply chains, and the level of local cyber defense maturity. For executives, this means risk is increasingly contextual, what affects one region might play out differently in another. A uniform cybersecurity policy will not fully mitigate these threats. Organizations must blend global oversight with regional intelligence to remain effective.

To make progress, C-suite leaders should ensure that their security teams integrate real-time intelligence feeds tailored to regional threat activity. Risk functions should build models that account for different threat actor behaviors, rather than relying on generalized assumptions. Understanding the intent and pattern of these groups will help in planning targeted defensive investments. Qilin’s cross-border presence and SafePay’s regional focus underscore how threat actors adjust for efficiency, something business leaders must match with equal adaptability.

Enhanced regulatory frameworks are shifting cyber risk management from internal controls to inclusive supply chain governance

Europe’s regulatory environment is tightening fast. Frameworks such as NIS2, DORA, CER, and the Cyber Resilience Act are raising expectations for how organizations manage not just their internal systems, but also their entire supplier ecosystems. These regulations demand accountability. Boards must prove they understand where cyber risk resides, whether inside their networks or within partners and service providers. For executives, this means cybersecurity can no longer be delegated purely to technical teams. It is now a strategic governance issue tied directly to operational resilience, business continuity, and brand trust.

The shift is reshaping boardroom priorities. Risk management now extends to mapping supplier dependencies, validating third-party security postures, and tracking compliance across jurisdictional boundaries. The scope is broad, but the reward is control and visibility. Companies aligning early with regulatory expectations will find themselves better equipped to respond quickly to ransomware events and regulatory inquiries alike.

For corporate leaders, this is not just an obligation, it is an opportunity to build credibility. When organizations can demonstrate informed oversight of their entire supply chain risk, they gain a strategic edge with regulators, investors, and customers. Adapting to regulations like NIS2 and DORA requires structured governance, measurable metrics, and continuous reporting. These processes will define leadership standards in Europe’s evolving cybersecurity landscape, positioning proactive organizations as resilient, dependable, and compliant in a market that demands both technical strength and strategic clarity.

Converging pressures from ransomware escalation, supplier vulnerabilities, and new regulations

The European business environment is facing three simultaneous pressures, ransomware attacks rising fast, supply chains becoming critical weak points, and new regulations imposing stringent accountability. Dr. Ferhat Dikbiyik, Chief Research and Intelligence Officer at Black Kite, made this clear: “Our research shows that some of Europe’s most significant ransomware incidents are defined less by the initial victim than by the scale of their downstream impact across an interconnected ecosystem.” His statement captures the essence of the problem. Modern organizations are no longer operating within isolated digital environments. Each partner, vendor, and customer connection brings shared exposure to risk.

For executives, this convergence of factors demands a strategic, integrated approach to cyber resilience. Traditional responses, focused only on patching systems or deploying new tools, are no longer sufficient. Instead, the focus must shift to coordinated oversight. Leaders need visibility into how risk moves through their operational networks and how one compromise can influence multiple tiers of their ecosystem. When ransomware spreads through a supplier or a service provider, the fallout affects brand trust, operational continuity, and regulatory compliance all at once.

A forward-looking organization will align its cybersecurity, compliance, and operational strategies under a shared governance model. This approach ensures that risk detection, incident response, and supplier monitoring are interconnected processes, not separate functions. Executives should demand regular reporting on third-party cyber exposure and establish escalation frameworks that connect technical findings directly to business impact. This clarity is essential for informed decision-making.

Black Kite’s study, built on ransomware tracking, vendor ecosystem analysis, and regulatory review, highlights that the challenge is expanding quickly. The organizations that succeed will be those that treat cybersecurity as a strategic capability, adaptable, data-driven, and embedded across every layer of their operation. By understanding where risk is concentrated and how it spreads, European businesses can stay ahead of both attackers and compliance pressures, building genuine resilience in a time when it matters most.

Main highlights

• Ransomware activity intensifies across europe’s largest economies: Ransomware incidents jumped 55.1% year on year, with Germany, the UK, France, Italy, and Spain seeing nearly 70% of total attacks. Leaders should prioritize investment in proactive detection and coordinated response strategies in these high-risk markets.
• Supplier networks emerge as a critical vulnerability: Third‑party breaches, like the Miljödata incident impacting over a million individuals, reveal how a single supplier compromise can disrupt entire ecosystems. Executives should mandate supplier risk assessments and continuous monitoring to strengthen cyber resilience.
• Ransomware groups adapt tactics to local and regional conditions: Groups such as Qilin and SafePay tailor campaigns to maximize local impact. Decision‑makers should ensure cybersecurity frameworks integrate country‑specific threat intelligence for faster and regionally aligned countermeasures.
• Regulation shifts accountability to the boardroom: Frameworks like NIS2, DORA, and the Cyber Resilience Act require organizations to manage cyber risk across their supply chain. Boards should embed cyber governance into enterprise strategy, ensuring transparency and compliance across all vendor relationships.
• Converging pressures demand integrated risk oversight: Rising attacks, supplier dependencies, and new regulations form a single, evolving challenge. Leaders should align cybersecurity, compliance, and operational continuity under unified governance to improve visibility, accountability, and resilience.