Manufacturing Cyber Statistics Guide: Ransomware, Downtime and Supplier Risk

Manufacturing has been the most attacked industry in IBM X-Force data for five years running, yet most board papers on the subject still quote numbers nobody can trace. This page collects the current manufacturing cyber statistics from primary publishers: the IBM X-Force Threat Intelligence Index 2026, the Verizon 2026 Data Breach Investigations Report (DBIR), the Sophos State of Ransomware in Manufacturing and Production 2025, the IBM Cost of a Data Breach industrial sector analysis, the Dragos 2026 OT Cybersecurity Year in Review and the Make UK Cyber Security in Manufacturing report. Each figure carries its publisher, report and edition in the same sentence or table row, and single vendor surveys are labelled as such. It is written for CISOs, plant and operations leaders, risk teams and insurers who need defensible numbers for investment cases. For the plant floor view (controllers, ICS advisories, exposure), read it alongside the OT and ICS Security Statistics Guide. Last reviewed: November 2026.

Key takeaways

• Manufacturing is the most targeted sector. The IBM X-Force Threat Intelligence Index 2026 puts manufacturing at 27.7% of the incidents X-Force observed in 2025, the fifth consecutive year at the top, with data theft the most common attack type.
• Vulnerability exploitation is now the main way in. The Verizon 2026 DBIR finds exploitation of vulnerabilities behind 38% of manufacturing breaches, ahead of phishing (13%) and credential abuse (11%).
• Suppliers are part of most breaches. The same DBIR snapshot shows third-party involvement in 61% of manufacturing breaches, and Make UK finds 30% of UK manufacturers hit by a cyber incident directly or through their supply chain in the past year.
• Ransomware is shifting from encryption to data theft. Sophos reports encryption in 40% of attacks on manufacturers in its 2025 survey, down from 74%, while extortion-only attacks rose from 3% to 10%.
• Preparedness lags the threat. Make UK finds only around half of UK manufacturers have an incident response plan, and Dragos reports 24% of manufacturing sites in its exercise data have no OT incident response plan.

Headline statistics

Statistics by theme

How often manufacturers are attacked

• Most targeted industry: IBM's X-Force Threat Intelligence Index 2026, published 25 February 2026, reports manufacturing as the most targeted sector for the fifth year, at 27.7% of incidents X-Force responded to in 2025. X-Force names data theft as the most common attack type in the sector. Across all sectors the same report finds attacks starting with exploitation of public-facing applications up 44%, and vulnerability exploitation the leading cause at 40% of incidents.
• Breach volume: the Verizon 2026 DBIR, covering October 2024 to November 2025 and more than 22,000 confirmed breaches overall, records 3,627 manufacturing incidents and 2,713 confirmed breaches. Verizon says the number of manufacturing breaches continues to grow, largely because of ransomware.
• UK picture: Make UK's Cyber Security in Manufacturing report (10 August 2026) finds 30% of manufacturers experienced a cyber incident in the past year, either directly or through their supply chain. Make UK does not publish its sample size on the report page, so treat it as a trade body survey indicator rather than a prevalence rate.
• Industrial ransomware: the Dragos 2026 OT Cybersecurity Year in Review (17 February 2026) counts 119 ransomware groups targeting industrial organisations in 2025, up from 80, affecting about 3,300 organisations, with manufacturing more than two thirds of victims. The Jaguar Land Rover Cyberattack 2025 shows how an attack on corporate IT stopped vehicle production across sites and the supplier base for weeks.

How attackers get in

• Patterns: the Verizon 2026 DBIR finds System Intrusion, Social Engineering and Basic Web Application Attacks account for 91% of manufacturing breaches, the same top three as the previous edition. External actors are behind 95% of breaches and internal actors 5%.
• Human element: present in 56% of manufacturing breaches (Verizon 2026 DBIR), below the 62% cross-industry figure, which reflects the weight of exploitation in this sector.
• Native tools go unseen: Dragos reports, in an April 2026 analysis of its 2025 engagements, that 56% of its network penetration tests found environments unable to identify adversary activity using PowerShell, RDP and WMI, and fewer than 5% had PowerShell execution logging enabled. Those are cross-industrial figures, not manufacturing only.

Ransomware and extortion

• Survey basis: the Sophos study was run by Vanson Bourne from January to March 2025 across 17 countries, with 332 manufacturing and production respondents from organisations of 100 to 5,000 employees that had been hit by ransomware. It is a single vendor survey of victims, so the percentages describe victims, not the whole sector.
• Why victims were hit: respondents cite lack of expertise (42.5%), unknown security gaps (41.6%) and lack of protection (41%), with an average of three internal factors per attack (Sophos 2025).
• Groups: Sophos X-Ops counted 99 distinct groups listing manufacturing victims on leak sites over twelve months, led by Akira, Qilin and Play.
• Cross-industry context: the Verizon 2026 DBIR puts ransomware in 48% of all breaches, with 69% of victims not paying and a median payment of USD 139,875. Verizon does not publish a manufacturing-only ransomware percentage in its executive summary, so do not quote 48% as a manufacturing figure.

Cost and recovery

• Breach cost: IBM's analysis of its Cost of a Data Breach Report 2024 puts the industrial sector average at USD 5.56 million, up 18% and about USD 830,000 per breach, the largest increase of any industry, ranking third of 17 industries. This is the latest industrial-specific figure IBM has published as a separate analysis; check for a newer edition before quoting it.
• Breach lifecycle: the same IBM analysis gives 199 days to identify and 73 days to contain an industrial breach, against global averages of 194 and 64 days.
• Automation gap: only 32% of industrial organisations make extensive use of security AI and automation, and those that do save about USD 1.9 million per breach (IBM 2024).
• Losses for smaller firms: Make UK's 2026 report finds 31% of manufacturers affected by supplier cyber attacks reported delays to customer deliveries, and almost a third either lack cyber insurance or do not know whether they are covered.

Data, motive and supply chain

• Data taken: internal data appears in 81% of manufacturing breaches, credentials in 26%, other data in 22% and personal data in 17% (Verizon 2026 DBIR). Designs, formulas and production data matter more here than in consumer sectors.
• Espionage: 15% of manufacturing breaches carry an espionage motive (Verizon 2026 DBIR), which supports protecting intellectual property even where ransomware dominates the headlines.
• Supplier assurance: secondary reporting of the Make UK 2026 findings (Computing, August 2026) states that 71% of respondents had not introduced cyber requirements for their suppliers. The figure is not on Make UK's own report page, so verify it against the full report before quoting.

Readiness and response

• Incident response plans: Make UK 2026 finds only around half of UK manufacturers have an incident response plan.
• OT response gaps: Dragos reports, from tabletop exercise data, that 24% of manufacturing sites have no OT/ICS incident response plan, the highest of any sector, and that manufacturing showed major challenges in four of seven core response capabilities (detect, communicate, contain and document).
• Shared IT and OT domains: Dragos found shared IT and OT Active Directory domains in nearly half of manufacturing assessments, more than three times the rate in oil and gas and electric. Shared domains let one stolen IT credential reach plant systems.
• Telemetry: 30% of Dragos incident response cases in 2025 began with someone reporting that something seemed wrong, and most of those lacked the telemetry to confirm what had happened.

What the numbers mean for defenders

• Small versus large manufacturers: a single-site firm gets most from KEV-driven patching of its firewall, VPN and file transfer systems, MFA on remote access and offline backups of ERP and production data. A multi-site group needs a central asset inventory, a separate OT identity domain, supplier tiering and an exercised plan for a coordinated production stop. See the Manufacturing Cybersecurity Programme Guide.
• Where identity fits: valid accounts, vendor VPN credentials and service accounts on MES, historian and ERP integrations are how many manufacturing intrusions move from IT to the plant. Credentials appear in 26% of manufacturing breaches (Verizon 2026 DBIR). See the Manufacturing Identity and OT Access Guide.
• Use the right framework profile: map controls to the NIST CSF manufacturing profile and IEC 62443 for plant systems. See the NIST CSF Manufacturing Profile Guide.

How to turn these statistics into a programme:

1. Baseline your own numbers: count internet-facing systems, open KEV entries, suppliers with remote access and plants with a tested response plan, so external figures are compared with internal ones.
2. Close the exploitation gap first: patch or isolate KEV-listed edge devices within the CISA deadlines, verify with an external scan, and keep a rollback image for each appliance before upgrading.
3. Tier suppliers: start with those holding remote access or production data, add minimum requirements at renewal and move vendor access to a brokered, recorded path piloted with one supplier first.
4. Separate identity domains: pilot an OT domain at one plant, migrate accounts in monitor mode, keep the old trust disabled rather than deleted until production is confirmed stable.
5. Exercise a production-stop scenario: run a tabletop covering ransomware with data theft, the shutdown decision, customer communication and supplier impact, then refresh this page's figures when each publisher releases its next edition.

Metrics that show the programme is working:

• KEV exposure: open KEV-listed vulnerabilities on internet-facing assets, target zero past the CISA due date.
• Supplier coverage: share of critical suppliers with contractual cyber requirements and brokered access.
• Response readiness: share of plants with an IR plan exercised in the last 12 months.
• Recovery time: hours to restore ERP and a production line's MES from backup in the last test.
• Detection of native tools: share of red team PowerShell, RDP and WMI actions that generated an alert.

Common failure patterns when using manufacturing statistics

• Quoting cross-industry figures as sector figures: the DBIR's 48% ransomware share and IBM's global breach cost are not manufacturing numbers. Use the sector snapshot rows above.
• Comparing different denominators: X-Force's 27.7% is a share of incidents IBM responded to, Make UK's 30% is a share of surveyed firms, and Sophos percentages describe ransomware victims only. They cannot be added or ranked against each other.
• Treating falling encryption as falling risk: fewer encrypted attacks (Sophos 2025) came with more extortion-only attacks and more data theft. Impact moved, it did not disappear.
• Citing old cost figures as current: IBM's USD 5.56 million industrial cost is from the 2024 report. Always state the edition.
• Ignoring the supplier route: with 61% of breaches involving a third party, a programme that only measures your own estate misses most of the exposure, as the Jaguar Land Rover Cyberattack 2025 showed for its supply chain.

Methodology notes and caveats

Practitioner checklist

• Quote each statistic with its publisher, report name and edition, and say whether it is a survey, telemetry or incident dataset.
• Use the Verizon manufacturing snapshot, not the cross-industry headline, for sector-specific claims.
• Compare external figures with your own KEV exposure, supplier access and IR plan coverage.
• Prioritise patching of internet-facing systems listed in the CISA KEV catalogue.
• Inventory suppliers with remote access or production data and set minimum cyber requirements.
• Separate OT identity from corporate Active Directory and remove standing vendor accounts.
• Plan for extortion without encryption: monitor egress and protect design and formula repositories.
• Exercise a production-stop scenario at least yearly, including supplier and customer communication.
• Review this page's figures each time IBM, Verizon, Sophos, Dragos or Make UK publish a new edition.

Standards and references

• IBM: 2026 X-Force Threat Index press release
• Verizon: 2026 Data Breach Investigations Report Executive Summary
• Sophos: The State of Ransomware in Manufacturing and Production 2025
• IBM: Cost of a data breach, the industrial sector
• Dragos: 2026 OT Cybersecurity Year in Review press release
• Dragos: Why is manufacturing the most targeted sector for OT cyber attacks
• Make UK: Cyber Security in Manufacturing
• CISA: Known Exploited Vulnerabilities Catalog

Related NHI Mgmt Group resources: OT and ICS Security Statistics Guide, Manufacturing Cybersecurity Programme Guide, Manufacturing Identity and OT Access Guide, Third-Party Risk Management Guide, Data Breach Statistics Guide.