Ransomware does not need to reach a manufacturer's control systems to stop production. Attackers only need to disrupt the enterprise IT systems a plant depends on, such as ERP platforms, identity services, or remote access gateways, and the shutdown cascades down to the floor on its own. Dragos researchers tracked 1,140 ransomware incidents against industrial organizations in Q2 2026 alone, a 12% increase from Q1, with manufacturing accounting for 65% of all victims (Help Net Security, 2026).
How Does an IT-Only Attack Stop a Production Line?
An attack that never touches operational technology can still halt production because modern plants depend on IT systems to function even when those systems are not part of the physical process itself. When a ransomware attack locks up virtualization infrastructure, identity services, or ERP platforms, plant staff often cannot log in, schedule production, process orders, or coordinate shipping. The safest and most common response is to shut the line down manually rather than risk running blind. Dragos points to a major Australian sugar producer as a clear example: a Gentlemen ransomware attack shut down the company's mills, yet researchers found no evidence the attackers ever reached the mills' industrial control systems at all (Help Net Security, 2026).
How Are Attackers Getting In?
The most common entry point in Q2 2026 was not a technical exploit. It was social engineering conducted over Microsoft Teams, where attackers impersonated IT support staff and talked employees into a screen-sharing session, then used that access to install remote tools like AnyDesk or Quick Assist (Help Net Security, 2026). Beyond that, compromised credentials, exposed VPN devices, exploitable internet-facing infrastructure, and credential-harvesting phishing domains rounded out the primary attack paths. None of these require any specialized knowledge of industrial control systems. They are the same tactics used against any office network, which is exactly why manufacturers cannot treat OT security as a separate problem from ordinary IT hygiene.
Which Parts of Manufacturing Are Being Hit Hardest?
Beyond manufacturing's overall 65% share of industrial ransomware victims, the Dragos Q2 2026 breakdown shows construction (176 incidents), equipment manufacturing (114), transportation and logistics (95), and food and beverage (70) as the most-targeted sub-sectors, along with 117 incidents against ICS support organizations such as integrators and engineering firms that serve manufacturers directly (Help Net Security, 2026). The three most active ransomware groups by claimed attacks were Qilin (140), Akira (129), and The Gentlemen (125). The U.S. accounted for 431 of the roughly 1,140 global incidents, well over a third worldwide.
What Should Manufacturers Actually Do About This?
Since the dominant attack path runs through enterprise IT and human behavior rather than through OT systems directly, the highest-value defenses are the ones that protect identity and access: verifying IT support requests through a second channel before granting any remote-access session, enforcing multi-factor authentication that resists credential-harvesting phishing, locking down and monitoring internet-facing VPN and remote access infrastructure, and segmenting networks so that a compromised ERP or identity system cannot automatically cascade into a decision to halt the plant floor. Employee awareness matters here specifically because the most common attack vector was a phone or Teams conversation, not a piece of malware. A well-trained employee who knows to verify IT support requests through a second channel is a more effective control than most technical defenses against this specific tactic.
Frequently Asked Questions
Do ransomware attacks on manufacturers usually reach the actual factory equipment?
Not typically. Recent industrial ransomware data shows most attacks compromise enterprise IT systems (ERP, identity services, virtualization, remote access) rather than operational technology directly, but the resulting IT outage still forces many plants to halt production manually as a precaution.
What happened in the Australian sugar producer ransomware attack?
A major Australian sugar producer had its mills shut down following a ransomware attack attributed to the Gentlemen group. Researchers found no evidence the attackers accessed the mills' industrial control systems. The shutdown resulted from disruption to the enterprise IT systems the mills depended on.
How are attackers most commonly gaining access to manufacturers right now?
Social engineering over Microsoft Teams was the leading tactic in Q2 2026, with attackers posing as IT support and convincing employees to start a screen-sharing session, then installing remote access tools. Compromised credentials and exposed VPN devices were also common entry points.
How much did industrial ransomware increase in 2026?
Dragos recorded 1,140 industrial ransomware incidents in Q2 2026, a 12% increase over the 1,020 incidents in Q1 2026, with manufacturing accounting for about 65% of all victims.
Does segmenting OT from IT networks prevent this kind of attack?
Segmentation helps limit how far an attack can spread, but it does not address the root cause in most of these incidents. The initial compromise happens through IT systems and human behavior, so identity security, verified remote-access procedures, and employee training matter just as much as network segmentation.