First, Black Kite defines medium-sized companies as companies with annual sales of $10 million to $1 billion. Unlike small and medium-sized companies, whose weaknesses and hardships are well known, and large companies, which receive extensive media coverage when damage occurs, mid-sized companies have fewer opportunities to be featured in cybersecurity discussions.
Black Kite's report analyzed 13,336 ransomware attacks that occurred between January 2023 and June 2026. We are examining how the unique position of medium-sized companies affects their ability to protect their systems.
A company is both a supplier to one company and a customer to another. As a supplier, you are required to take security measures, and as a customer, you need to conduct a risk assessment of your supplier companies.
"Typically, in large companies, responding as a supplier and assessing the risk of a supplier are treated as separate issues, with different teams working on their own budgets," the report said. On the other hand, medium-sized companies often do not have the personnel to handle these two issues because of their small staff.
The report notes that supplier and customer perspectives are just different ways of looking at the same issue: "cyber risk across the supply chain."
A system in which a team of 2 or fewer people is in charge of 300 companies
The industries most affected are manufacturing, professional services, construction, and wholesale trade. Many of these companies supply products and services to other companies, and damage caused by cyberattacks rapidly spreads to downstream and surrounding business partners (Note 2) (Note 3).
"When one of these companies is attacked, the incident is logged in their name, but the damage doesn't end there," Black Kite said.
The report points out that these supply chain risks are why large companies with mid-sized suppliers require mid-sized companies to answer a large number of security questions. The report cites U.S. and European regulations that codify supplier cybersecurity responsibilities as examples.
However, midsize companies are often unable to adequately adapt to the monitoring and security demands of their customers.
"Industry research on vendor risk management programs confirms that teams of two or fewer are responsible for more than 300 suppliers, a ratio that makes continuous manual monitoring impossible," Black Kite researchers wrote.
The target is the âsmallest mid-sized companyâ 72% of attacks are concentrated in North America
Ransomware attacks were not evenly distributed among midsize businesses during the study period. The smallest group, companies with annual sales of $10 million to $50 million, accounted for about half of the total, followed by "core medium-sized companies" with annual sales of $50 million to $500 million, at 40 to 45 percent. Only a small number of "top midsize companies" with annual sales of $500 million to $1 billion were attacked. According to Black Kite, the number of top midsize companies attacked decreased by 64% from 126 in 2023 to 45 in 2025.
The report is based on data collected from a network of 120,128 mid-sized companies in North America and Europe. However, the damage was largely concentrated in North America. During the study period, 72% of attacks targeting midsize companies were targeted at North American companies. While the number of affected companies in North America increased from 2023 to 2026, the number of affected companies in Europe remained almost the same (editor's note 1).
