INDUSTRY FACT FILE · TEXTILES, APPAREL & CONSUMER MANUFACTURING

Five New Case Studies in Textiles and Apparel Security

Original 2026 case studies, each written as a blog post, showing how current threats play out in mills, exporters, footwear and consumer goods manufacturers and brands, and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Order Book That Went Dark Before the Vessel Sailed 3.  Case Study 2: The Buyer Who Never Changed Banks 4.  Case Study 3: The Sample Room That Lived on a Shared Drive 5.  Case Study 4: The D2C Site That Accepted Everyone's Passwords 6.  Case Study 5: The Dyehouse That Stopped Three Factories

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining attack techniques and control failures widely observed in textiles, apparel and consumer manufacturing with the obligations that apply in India as of October 2026—in particular CERT-In's Directions and audit guidelines, SEBI disclosure for listed companies, DPDP, PCI DSS, GST and customs flows and the buyer requirements that reach Indian factories.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Organisation type	Core threat	Regulatory lens	Primary bundles
1. The Order Book That Went Dark Before the Vessel Sailed	Garment exporter	Ransomware encrypting ERP and export documents	CERT-In; GST and customs; buyer contract	B3, B7, B8
2. The Buyer Who Never Changed Banks	Home textiles exporter	Business email compromise diverting export proceeds	CERT-In; banking; buyer contract	B10, B2, B7
3. The Sample Room That Lived on a Shared Drive	Footwear manufacturer	Contractor theft of design data	Buyer confidentiality; DPDP; forensics	B3, B6, B8
4. The D2C Site That Accepted Everyone's Passwords	Consumer products brand with a D2C arm	Credential stuffing and web skimming	DPDP; PCI DSS; consumer rules	B2, B6, B7
5. The Dyehouse That Stopped Three Factories	Processing job-worker and its garment customers	Supplier ransomware breaking fabric supply	CERT-In; buyer contracts; supplier contracts	B9, B10, B7

Every line kept sewing. The season's biggest order still missed its ship.

At a glance
Organisation	A garment exporter (“Garmco A”) with four factories supplying two global brands
Threat	Phishing leading to domain compromise and ransomware across ERP, cutting-room software, file servers and the document system
Why it is new	Export revenue depends on documents and dates, and both depend entirely on IT
Codec Networks services	Segmentation and backups, SOC, forensics (Bundles B3, B7, B8)

The scenario

A phishing email gave attackers a foothold in Garmco A's network. Over two weeks they escalated to domain administrator unnoticed; the exporter had endpoint protection but nobody watched its alerts.

Ten days before the season's largest shipment, ransomware encrypted ERP, the cutting-room system, file servers holding packing lists and invoices and the backup server, which sat on the same domain.

Lines could sew from printed plans, but no packing list, e-invoice or customs document could be produced. The order missed its vessel, part went by air at Garmco A's cost, and the buyer placed the vendor under review.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• Backups were online and domain-joined, so they were encrypted too.
• Shipping depended entirely on IT with no manual plan.
• EDR alerts were not monitored 24x7.
• No restart sequence for ERP, documents and e-invoicing.

The impact

Garmco A paid air freight and buyer penalties, lost margin on the season, reported the incident and had to evidence remediation to the buyer before new programmes were awarded.

The regulatory lens

• CERT-In Directions: incident reported within six hours; logs needed for investigation.
• GST and customs: e-invoices and export filings delayed; compliance flows had to be reconstructed.
• Buyer contract: delivery penalties and a vendor security review.

How Codec Networks would help

Need	Codec Networks response	Bundle
Separate and recover	Segmentation, immutable backups, tested ERP, document and e-invoicing restores	B3
Detect early	24x7 SOC with EDR monitoring and threat hunting	B7
Investigate and report	Forensics, root cause, CERT-In reporting and buyer evidence	B8

Key lessons Keep backups immutable and off the domain. Plan and rehearse manual shipping. Monitor EDR around the clock. Test restores of ERP, documents and e-invoicing together.

No malware touched a single server. The money simply went somewhere else.

At a glance
Organisation	A home textiles exporter (“Texco B”) with one large European buyer
Threat	Compromised merchandiser mailbox used to study the payment cycle and send new bank details from a look-alike domain
Why it is new	Export trade runs on email, and payment instructions are rarely verified by a second channel
Codec Networks services	BEC simulation and controls, mailbox and application security, SOC (Bundles B10, B2, B7)

The scenario

Attackers phished a senior merchandiser at Texco B and set a mailbox rule to forward and hide messages from the buyer's accounts team. For two months they read every exchange about orders, invoices and payment timing.

Days before a large remittance, an email from a look-alike domain, quoting genuine invoice numbers and the merchandiser's signature, told the buyer that Texco B had changed banks. The buyer's team updated the details without calling.

The remittance went to the attackers' account. Texco B discovered the loss when it chased the payment; recovery efforts through the banks retrieved only a fraction, and buyer and exporter disputed who should bear the loss.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• No MFA on mailboxes and no alerting on forwarding rules.
• No verification procedure for bank-detail changes agreed with the buyer.
• No look-alike domain monitoring.
• Finance and merchandising never trained with simulations.

The impact

Texco B lost most of a large remittance, faced a cash crunch, strained its most important buyer relationship and reported the incident.

The regulatory lens

• CERT-In Directions: mailbox compromise reported within six hours of discovery.
• Banking: recall requests through correspondent banks with limited success.
• Buyer contract: dispute over liability; new payment verification clauses agreed.

How Codec Networks would help

Need	Codec Networks response	Bundle
Train and test	BEC simulation for merchandising and finance; verification procedures with buyers	B10
Harden identity and email	MFA, conditional access, mailbox rule controls, domain protections	B2
Watch for the signs	SOC alerting on forwarding rules, impossible travel and look-alike domains	B7

Key lessons Enforce MFA and alert on mailbox rules. Agree bank-detail verification with every buyer. Monitor look-alike domains. Run BEC simulations before the season.

Next season launched on a marketplace three weeks before the brand launched it.

At a glance
Organisation	A footwear manufacturer (“Shoeco C”) developing a range with a global brand
Threat	A design contractor's account, left active after the project, used to download tech packs, lasts and costings over several weeks
Why it is new	Designs are shared widely in cloud folders and contractor access outlives projects
Codec Networks services	IP protection, privacy and data governance, forensics (Bundles B3, B6, B8)

The scenario

Shoeco C collaborated with the brand in a shared cloud folder holding tech packs, last files, material specifications and costing sheets. A freelance designer engaged for the project kept access after the engagement ended.

Over six weeks the account downloaded the entire range and the costing sheets. No download monitoring was in place and the account was not in the leaver process because the designer was a contractor.

Look-alike styles appeared on a marketplace before the brand's launch. The brand invoked confidentiality clauses, demanded an investigation and paused the next programme pending evidence.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• Design data was not classified or restricted by need.
• Contractor accounts were outside the leaver process.
• Downloads were not monitored or limited.
• No forensic readiness to show what was taken and when.

The impact

Shoeco C lost the next programme pending investigation, incurred legal costs, rebuilt its design-data governance and renegotiated contractor terms.

The regulatory lens

• Buyer contract: confidentiality breach and demand for an independent investigation.
• DPDP: personal data of staff and contractors in the exported files.
• Forensics: cloud audit logs needed to evidence the downloads for the brand and legal action.

How Codec Networks would help

Need	Codec Networks response	Bundle
Protect the range	Classification, least privilege, DLP and download controls on design folders	B3
Govern the data	Contractor lifecycle, retention and personal data controls	B6
Prove it	Forensic readiness and investigation using cloud audit logs	B8

Key lessons Classify and restrict design data. Put contractors in the leaver process. Monitor and limit downloads. Keep audit logs that can prove what happened.

The sale broke records. So did the fraud.

At a glance
Organisation	A consumer products brand (“Brandco D”) running a D2C site, an app and a loyalty programme
Threat	Credential stuffing taking over consumer accounts, followed by a skimming script injected through a marketing plug-in
Why it is new	D2C platforms are built from SaaS and third-party scripts and run by marketing as much as IT
Codec Networks services	Web, API and app testing, privacy programme, SOC (Bundles B2, B6, B7)

The scenario

During a festive sale, automated login attempts using leaked credentials from other sites took over thousands of Brandco D accounts. Attackers redeemed loyalty points, changed delivery addresses and placed orders with stored payment methods.

Separately, a marketing team had installed an unvetted analytics plug-in on the checkout page. It was compromised and began skimming card details entered during the sale.

Complaints surged, the payment gateway raised fraud alerts and Brandco D had to notify consumers, work with its acquirer on a card-data investigation and prepare for DPDP breach obligations.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• No bot management or rate limiting on login.
• No MFA or step-up verification for address changes and stored payments.
• Third-party scripts were uncontrolled on checkout.
• No testing before the sale and no SOC visibility of account takeover patterns.

The impact

Brandco D refunded fraudulent orders, lost loyalty programme value, faced a card-data investigation and consumer complaints, and paused the D2C channel for a week.

The regulatory lens

• DPDP: consumer personal data compromised; breach intimation workflow prepared.
• PCI DSS: skimming on checkout triggered forensic investigation and acquirer obligations.
• Consumer Protection (E-Commerce) Rules: consumer grievance handling and transparency.

How Codec Networks would help

Need	Codec Networks response	Bundle
Test and harden the channel	Web, API and mobile testing; bot controls; script integrity; PCI DSS-aligned checkout	B2
Govern consumer data	DPDP programme: data mapping, consent, retention, breach workflow	B6
See the attack	SOC detection of credential stuffing, redemption anomalies and checkout changes	B7

Key lessons Put bot controls and step-up verification on consumer accounts. Control every script on checkout. Test before every sale event. Prepare DPDP and PCI DSS breach workflows in advance.

The garment units were untouched. Their fabric never arrived.

At a glance
Organisation	A dyeing and finishing job-worker (“Dyeco E”) supplying three garment units of one exporter
Threat	Ransomware encrypting the job-worker's order, lot-tracking and dispatch systems
Why it is new	In a cluster supply chain, a processor's incident is the exporter's shortage
Codec Networks services	Supplier assurance, joint exercises, SOC (Bundles B9, B10, B7)

The scenario

Ransomware encrypted Dyeco E's order and lot-tracking systems. Fabric could still be dyed, but lots could not be matched to orders, released or invoiced, and dispatch stopped.

The exporter's three garment units ran out of processed fabric within days in peak season. Dyeco E was the sole processor for the programme and had never been assessed; its contract had no security or notification clause.

Lines restarted only when Dyeco E rebuilt enough systems to release fabric manually. The exporter missed deliveries and its buyer audited the supply base.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• Critical job-workers had never been assessed for cyber risk.
• Contracts were silent on security and incident notification.
• No buffer stock or alternate processor for the programme.
• Dyeco E had no tested backups or manual release plan.

The impact

The exporter missed deliveries and faced a buyer audit; Dyeco E bore recovery costs and had to accept new contract terms to retain the business.

The regulatory lens

• CERT-In Directions: Dyeco E reported the incident within six hours.
• Buyer contract: delivery penalties and a supply-base audit for the exporter.
• Supplier contract: renegotiated with security, backup and notification clauses.

How Codec Networks would help

Need	Codec Networks response	Bundle
Know your critical suppliers	Supplier assurance: tiering, proportionate assessments, contract clauses	B9
Rehearse the outage	Joint supplier incident exercises and buffer planning	B10
Detect on both sides	SOC with EDR for the job-worker; alerting on supply anomalies for the exporter	B7

Key lessons Assess the suppliers that can stop your lines. Put security and notification in contracts. Hold buffers or alternates for critical processing. Exercise supplier outages together.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com