Industrial ransomware: what it means for OT-adjacent identity controls

TL;DR: 1,140 ransomware incidents affected industrial organisations in Q2 2026, up 12% from Q1, according to Dragos, with attackers increasingly abusing internet-facing edge devices, RMM tools, valid accounts and credential theft to hit enterprise IT systems that support OT rather than directly manipulating control systems. The governance problem is less ICS malware than identity, access and remote-management exposure that lets ransomware cascade into operational downtime.

Editorial analysis by NHI Mgmt Group, based on content published by Dragos: “Industrial Ransomware Analysis for Q2 2026”.

By the numbers:

• Dragos identified 1,140 ransomware incidents affecting industrial organisations in Q2 2026, a 12% increase over the 1,020 incidents recorded in Q1.
• Manufacturing accounted for 747 incidents, or 65% of all industrial ransomware cases in Q2 2026.

Key questions

Q: Why do passwords alone create risk for remote access and privileged accounts?

A: Passwords alone are weak because they are reusable, easily phished, and often exposed through poor user behavior or credential theft.

Q: Why does ransomware in industrial environments cause OT downtime without touching controllers?

A: Industrial operations depend on enterprise IT, especially identity services, virtualization, ERP and remote connectivity.

Q: What are the signs that attackers are preparing industrial ransomware impact?

A: Look for credential harvesting, anomalous use of remote management tools, browser-stored secret access, security-tool tampering and activity against backup or hypervisor systems.

Practitioner guidance

• Harden every internet-facing management surface Inventory VPN appliances, RMM platforms, remote support tools and appliance consoles, then remove exposed or legacy access paths that are not explicitly required for operations.
• Eliminate standing administrative access Move privileged operators, service accounts and remote support identities to just-in-time patterns so that no account remains continuously usable across critical systems.
• Enforce MFA on legacy access paths Prioritise VPNs, remote admin portals and break-glass paths that still rely on passwords alone, because the article shows those paths repeatedly seed industrial ransomware intrusion chains.

Bottom line: Industrial ransomware is increasingly an enterprise access and resilience problem rather than a controller-focused attack problem.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →