IT to OT lateral movement: are your controls keeping up?

TL;DR: Coca-Cola's Fairlife subsidiary was hit by ransomware on July 16, 2026, prompting a nationwide U.S. manufacturing shutdown after intruders reached production-related infrastructure and exposing how little many organisations can see across IT and OT boundaries, according to Ordr. The control problem is not just intrusion, but the inability to prove where lateral movement ends before operations are forced offline.

Editorial analysis by NHI Mgmt Group, based on content published by Ordr: “How a Single Compromised Laptop Can Shut Down a Factory”.

Key questions

Q: What breaks when IT and OT networks are not segmented?

A: When IT and OT are not segmented, ransomware can move from business systems into production systems, and defenders often cannot prove where compromise stops.

Q: Why does poor visibility across converged networks increase operational risk?

A: Because teams cannot distinguish normal cross-domain traffic from attacker movement if they do not know what systems should communicate in the first place.

Q: What are the signs that lateral movement is reaching production systems?

A: Look for endpoints initiating industrial protocols, remote sessions to systems they have never touched before, vendor connections expanding beyond their normal scope, or traffic patterns that do not match the established baseline.

Practitioner guidance

• Map IT-to-OT communication paths Inventory every device, account, and protocol that can cross from corporate IT into production systems, then remove any path that is not explicitly required for operations.
• Baseline normal device behaviour Passively learn which assets talk, when they talk, and which protocols they use so anomalous connections to plant systems can be flagged immediately.
• Enforce least-privilege segmentation Use segmentation controls to ensure each host or service can reach only the systems it genuinely needs, especially across IT and OT trust boundaries.

Bottom line: The Fairlife incident shows how quickly an apparently ordinary IT compromise can become an operational shutdown when teams cannot prove whether production systems are exposed.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →