Black Kite Report Finds 76% Surge in Ransomware Attacks on Financial Institutions

Black Kite announced in a press release its 2026 State of Financial Services report, which shows a 76 percent year-over-year increase in direct ransomware attacks on financial institutions in the first quarter of 2026. The report also found that 50 percent of financial vendor ecosystems contain critical vulnerabilities, creating a dual threat from both direct and supply chain attacks.

The report indicates that after a temporary decline in 2024 due to law enforcement actions against major ransomware groups, attacks rebounded in 2025 as new threat groups emerged. The number of distinct groups targeting the financial sector rose from 37 in 2023 to 48 in 2025, led by Qilin, Akira, and Kill Security. Investment firms have now overtaken banks as the most targeted segment, with 84 incidents reported in 2025 compared to 36 in banking.

Black Kite’s research highlights a broader rise in software vulnerabilities, with over 48,000 CVEs published globally in 2025, an 18 percent increase from the previous year. More than half of financial services vendors carry high-severity vulnerabilities, while AI adoption is expected to push vulnerability discovery further. The company notes that vulnerability exploitation has now surpassed phishing as the primary method of initial breach entry, underscoring the growing operational risk within financial supply chains.