Ransomware on the Shop Floor: Cybersecurity Threats in Manufacturing

Between January and September 2025, ransomware crews claimed 4,701 victims, and 2,332 of them, half, were in critical-infrastructure sectors, according to KELA's count. Manufacturing grew fastest of any sector: 838 attacks, up 61% on the same nine months of 2024. A plant that cannot ship loses money by the shift, and the people pricing ransom notes have read the same spreadsheet as the plant manager.

This page covers cybersecurity threats in manufacturing as of October 2026: who counted the attacks, why factories pay, how attackers reach the production floor, what CISA's 2026 advisories say about factory equipment, and where to start.

Each counter uses its own method (leak-site claims, confirmed attacks, industrial victims only), so the totals never agree. The ranking does, and manufacturing sits at the top of all four. KELA named healthcare and energy beside it among the most targeted; our pages on healthcare and energy and utilities cover those two.

Operational technology (OT) was built for uptime and precision. Programmable logic controllers, human-machine interfaces and manufacturing execution systems run for a decade or more, often on software nobody can patch without stopping the line, on networks designed long before anyone said zero trust. Comparitech estimated $17 billion in downtime from 858 confirmed attacks on manufacturers between January 2018 and October 2024, at about $1.9 million per day of downtime and 11.6 days per attack, so a seven-figure ransom demand arrives already priced in lost shifts.

In a 2024 survey of about 2,000 respondents across 16 countries, Palo Alto Networks and ABI Research found 72% of attacks on OT environments originated on the IT side. The line can stop without anyone touching a controller, because the systems that schedule, ship and invoice are encrypted. Dragos found that in Q2 2026 no ransomware operator reached Stage 2 of the ICS Cyber Kill Chain, the stage where an attacker works the control system itself, and that extortion is drifting toward stealing data rather than encrypting it.

Some controllers skip the office entirely. Joint advisory AA26-231A, released August 19, 2026 by NSA, CISA, FBI, DOE and EPA, describes an active campaign against Siemens S7 PLCs reachable from the internet and names Critical Manufacturing among the affected sectors. Our Siemens S7 PLC hardening guide maps each S7 family to its protections and puts the advisory's mitigations in a working order, and data diodes vs firewalls covers the boundary between plant and office.

We counted CISA's industrial control system advisories for 2026: 256 of the 386 published from January 1 to October 8 list Critical Manufacturing as an affected sector, 66%, against 332 of 465 (71%) in 2025. Those 256 advisories carry 1,384 vulnerabilities between them, 202 include at least one scored 7.0 or higher, and 68 include one scored 9.0 or higher.

Method: we pulled CISA's public CSAF advisory files (github.com/cisagov/CSAF, OT folder) on October 12, 2026, kept ICSA advisories by initial release date, and read each file's "Critical infrastructure sectors" note with jq -r '.document.notes[] | select(.title=="Critical infrastructure sectors") | .text'. An advisory can name several sectors. Medical device advisories (ICSMA) are excluded. Severity is the highest CVSS v3 score in the advisory, or v4 where no v3 score is given.

Siemens and Rockwell alone account for 105 advisories in about 40 weeks, more than two a week, and a patch is not always on offer: Dragos found 26% of the advisories it reviewed for 2025 came with no patch or mitigation from the vendor. Rerun the jq line against the CSAF folder each Monday and filter by the vendors on your floor; the list that comes back is your week's reading.

We counted this ourselves: if your plant runs Siemens or Rockwell equipment, a new government advisory about that kind of equipment arrives most weeks, so knowing exactly which models you own is what turns that stream into a short to-do list.

Dragos reported that ransomware sat in OT environments for an average of 42 days in 2025, against 5 days for organizations with full OT visibility. Visibility starts with a list: every PLC, HMI and historian server, its firmware version, and what it talks to. Passive discovery tools built for industrial networks, such as Claroty, the Dragos Platform and Nozomi Networks Guardian, build that list by listening to traffic instead of probing devices that may fall over when asked a question. AA26-231A names all three as examples of ICS-aware intrusion detection.

With the list in hand, the next steps follow in order: match it against the advisories above, segment the plant network from the office with an industrial firewall, keep offline copies of PLC programs and device configurations alongside the IT backups, and write a recovery plan that says who restarts which line. Our industrial engineering cyber resilience guide covers that plan, and the manufacturing industry page collects the rest of our coverage.

• CISA: Industrial Control Systems
• CISA: ICS advisories in CSAF format
• AA26-231A: Defending Against an Active Threat to Siemens S7 Series PLCs
• Dragos: 2026 OT/ICS Cybersecurity Year in Review

CISA publishes ICS advisories for vendors and asset owners in the Critical Manufacturing sector, one of the 16 US critical infrastructure sectors, and Dragos reports industrial ransomware quarterly.

Sources: KELA: Escalating Ransomware Threats to National Security, Industrial Cyber: Half of 2025 Ransomware Attacks Hit Critical Sectors, Comparitech: 2025 Ransomware Roundup, Infosecurity Magazine: Ransomware Downtime Costs Manufacturers $17bn, Dragos: 2026 Year in Review, Dragos: Industrial Ransomware Analysis Q2 2026, Palo Alto Networks: State of OT Security 2024, CISA: AA26-231A, House hearing transcript, July 22, 2025, CISA CSAF repository