INDUSTRY FACT FILE · MANUFACTURING & INDUSTRIAL PRODUCTION

Threat Landscape: Top Cyber Threats Facing Manufacturing and Industrial Production

The 18 most relevant cyber threats, attacks and industry challenges for engineering, machinery, electronics, industrial equipment and component manufacturers, and the impact each one has on plants, customers and suppliers.

Manufacturers attract ransomware groups because downtime is measured in lost output and contractual penalties, which makes victims more likely to pay; they attract competitors and state actors because designs, recipes and customer data are valuable; and they attract fraudsters because finance teams pay hundreds of suppliers. The attack surface is unusually wide: legacy PLCs and HMIs, ERP and MES that everything depends on, OEMs with remote access, suppliers with integrations and, increasingly, IIoT devices and connected products.

Landmark incidents show the pattern. Norsk Hydro (2019) ran aluminium plants manually for weeks after ransomware; Honda (2020) paused production at several plants after malware designed to stop industrial processes; Toyota (2022) lost a day of output at all 14 Japanese plants when one supplier was hit; Clorox (2023) spent months processing orders manually. In India, Seqrite's 2026 threat report counts manufacturing among the most targeted sectors, and an engineering-services company in a major industrial group disclosed a ransomware incident in early 2025.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by manufacturing segment (Codec Networks assessment).

4.1 Ransomware and the ERP dependency

Attackers rarely need to touch a PLC to stop a plant. Encrypting ERP, MES and file servers removes the ability to schedule, pick, label and ship; plants fall back to paper at a fraction of capacity, as Norsk Hydro and Clorox experienced.

• Questions to test: Which plant processes depend on ERP and MES? Can we run and ship without IT for a week? Are backups immutable and restores tested? Would EDR and the SOC catch the intrusion before encryption?
• Relevant services: dependency mapping, segmentation, backup and recovery testing, EDR validation, crisis exercises.

4.2 Suppliers and just-in-time

In a lean supply chain, a supplier's incident is your outage. Toyota's 14-plant stoppage in 2022 came from one parts supplier's systems, not Toyota's own.

• Questions to test: Which single-source or JIT suppliers could stop our lines? Have they been assessed? Do contracts require security and incident notification? Do we hold buffers?
• Relevant services: supplier cyber risk programme, contract clauses, buffer planning, joint exercises.

4.3 OEM remote access and PLC integrity

Automation vendors keep standing remote links to maintain machines and often share credentials across customers. A phished vendor account becomes a path to PLC engineering software.

• Questions to test: Which OEMs can reach our control networks? Is access brokered, time-bound and recorded? Do we verify PLC logic integrity and control changes?
• Relevant services: remote access review and brokering, PLC change control, OT monitoring, vendor assessments.

4.4 Design and intellectual property

A manufacturer's value is in its drawings, recipes and customer relationships. Leavers, contractors and espionage groups all target PLM and CAD repositories, often through cloud sharing.

• Questions to test: Is design data classified and access-controlled? Are uploads to personal cloud monitored? Are leaver procedures enforced on day one?
• Relevant services: data classification, DLP, PLM access reviews, user activity monitoring, forensic readiness.

4.5 Detection, reporting and the 6-hour clock

CERT-In requires reporting within six hours of noticing an incident, and listed companies disclose quarterly. Plant networks are usually unmonitored, so intrusions are found late and reported late.

• Questions to test: Are IT and OT monitored 24x7? Do we see remote sessions and engineering activity? Is there a playbook covering containment, safe plant operation, CERT-In reporting and disclosure?
• Relevant services: IT/OT SOC, playbooks, incident records, joint drills with plant teams.

• CERT-In: incidents reported within six hours of noticing them; logs available for investigation.
• SEBI LODR: listed manufacturers disclose cyber incidents and data loss in the quarterly corporate governance report.
• NCIIPC: incidents affecting notified protected systems require coordination.
• DPDP: incidents involving employee, dealer or consumer personal data trigger breach intimation once provisions commence in May 2027.
• Customers and the EU CRA: contract clauses require incident notification to OEM customers; manufacturers of connected products sold in the EU report actively exploited vulnerabilities and severe incidents.
• Insurers: policies require prompt notification and evidence that warranted controls were in place.

• If ERP went dark tonight, could we ship tomorrow—and for how long?
• Which supplier's outage would stop our lines, and have we assessed them?
• Who can reach our PLCs from outside, and is every session recorded?
• Could a leaver walk out with our drawings without anyone noticing?
• Do we have offline backups of PLC programs and a tested plant restart plan?
• Could we detect, contain and report an incident within six hours while keeping the plant safe?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific organisation. Public incident references are summarised from widely reported events and company disclosures.