(TLP:CLEAR) Ransomware Resilience – Recent Research Sharpens the Picture on Who Ransomware Targets and How It Gets In

Summary: Two recent reports clarify where ransomware pressure lands and how intrusions begin. Black Kite’s “Mid-Market Is the Routine Target” finds that mid-market organizations, those with annual revenues between $10M and $1B, absorb the bulk of ransomware activity rather than large enterprises. According to Black Kite, across 13,336 incidents from January 2023 to June 2026, 73% struck mid-market companies, and that share held steady even as total incidents rose 44%. Black Kite ties the pattern to a capacity gap, noting that smaller security teams face the same exposure as large enterprises with fewer resources.

Additionally, Beazley Security’s “Quarterly Threat Report for Q2 2026” speaks to how those intrusions start, reporting that 67% began with compromised credentials against exposed VPN and remote desktop services.

Analyst Note: This research provides a useful benchmark for water and wastewater utilities, many of which fit the mid-market profile it describes: lean IT and OT teams facing threats aimed at far larger organizations. Because the findings consistently point to stolen credentials on exposed remote access as the way in, WaterISAC encourages members to confirm multi-factor authentication (MFA) on all VPN and remote desktop services, prioritize patching of internet-facing systems, and review accounts for credential exposure.

Original Source: https://blackkite.com/reports/2026-mid-market-report/

Additional Reading:

• (TLP:CLEAR) JadePuffer Ransomware – First Reported Use of Agentic Ransomware
• (TLP:CLEAR) FBI Warns of TeamPCP Software Supply Chain Compromises
• Ransomware Resilience – Understanding Ransomware Behaviors and the Typical Ransomware Attack Chain

Related WaterISAC PIRs: 6, 7, 7.1, 10, 10.2, 12