Despite headline-grabbing cyber-attacks on some of the world’s biggest firms, research reveals that cyber-criminals are targeting the middle market the most.

About three in four ransomware victims with a known revenue figure were mid-market firms from 2023 to the first half of 2026. This is according to a new report from Black Kite, which defines mid-market firms as those earning between $10 million to $1 billion a year.

The report puts mid-market firms into three specific contexts – a routine target of ransomware, a supplier held accountable by larger customers, and a buyer with its own supply chains.

All these factors – and the smaller teams typically making up a mid-market firm – make them more liable to attacks along their supply chain and at greater risk of financial damage.

Of the 13,336 tracked ransomware incidents, 73% struck mid-market companies, which the stattisic holding steady over the past three years: 74.6% in 2023, 72.1% in 2024, 74.0% in 2025, and 72.3% in the first half of 2026.

In the same time period, incidents grew 44%, with mid-market firms holding their share of the damage.

Black Kite also found that 28.3% of firms monitored carry at least one known exploited vulnerability on an internet-facing system. This figure climes with revenue, the upper band at 52%, largely driven by the wider surface area of a bigger company rather than weak security posture.

Over half (54.7%) of the segment runs at least one unpatched public-facing system, with 48.1% carrying high or critical severity vulnerability.

Further, about a third (32.3%) already have credentials circulating in stealer logs, opening the firms up to more attacks.

Recommended reading

• Cybersecurity in 2024 | The High Cost of Innovation
• Report: AI Enhanced Two Thirds of Ransomware Attacks
• 87% of Firms Hit By AI Cyber-attacks
• AI in Cybersecurity | Navigating the Promises and Risks
• CISOs Seeing More Impact from AI Cyber Threats

Delving into targeted mid-market firms, it appears that those sitting in the lower revenue band make up the largest proportion, representing 50.5% to 57.2% of all attacks.

While the majority (72%) of victims are North American, Europe is closing that gap, seeing a 47% increase year-on-year of attacks.

Manufacturing firms are the most targeted sector (25.8%),  followed by professional and technical services and construction.