Sector dossier for Automation Machinery Manufacturing: victim-claim volume, active ransomware groups, and observation window.
Counted under this exact label: labels that differ only in case or spelling have their own pages, and a claim whose sources disagree on the sector is counted under none.
Related: observed activity profiles by country and sector, the victim-claim directory for the individual records behind these totals, and the Intelligence Lab sector crosshairs panel.
How to cite: Dragons Eye Ransomware Tracker, “Ransomware activity in the Automation Machinery Manufacturing sector”, provider-observed ransomware claim data as of 2026-07-14, this page's URL. Keep the observed-claim caveat with any reused figures; the methodology documents the evidence model and the data-quality dashboard quantifies screening and exclusions.
Source: reconciled leak-site victim claims aggregated from documented public monitoring providers. Independent providers are distinguished from mirrors, and no provider count verifies an underlying allegation. Definitions for every term used here are in the glossary.
Victim records are provider-reported allegations, not independently verified breaches. Published for research, defense, and educational use.
Data as of (the observed time of the newest claim record in this page's prerender data snapshot; snapshot built ; dataset version sig-c8140e6930616b9f0c8a1e58f11be44ebebfb4fe8a82be4757d96f7e38bf4737).