Loss of Productivity and Revenue (T0828) is the business cost of an attack on industrial operations, and ATT&CK's own examples show it arrives most often through IT incidents in environments that are not properly separated. The technique sits in the ATT&CK for ICS Impact tactic (TA0105). ATT&CK describes it as one of the more granular goals of adversaries that is not necessarily detectable in itself. This guide explains what the procedure examples show, how to measure and reduce the exposure, and how to keep producing when IT is down. It is written for OT security leads, plant and operations managers, and the risk and continuity teams who support them.
Key takeaways
- Most examples are IT incidents with plant consequences. Ransomware such as Ryuk, LockerGoga, NotPetya and EKANS appears in ATT&CK's T0828 list, alongside targeted ICS attacks.
- Precautionary shutdowns count. Lion and Colonial Pipeline halted operations to protect systems, and the lost output was the same as if the plant had been attacked directly.
- There is no detection analytic for the loss itself. ATT&CK v20 states that no standard detection method exists, so effort goes into the precursors and into resilience.
- Manual operation preserves some output. ATT&CK records Norsk Hydro plants switching to manual operations and a Ryuk victim keeping a shop floor running on paper.
- Quantify it before an incident. A business impact analysis that prices downtime by site and process turns resilience spending into a decision the board can make.
What T0828 covers
ATT&CK for ICS v20 describes Loss of Productivity and Revenue as disruption, and even damage, to the availability and integrity of control system operations, devices and processes that causes lost productivity and revenue. It states that the technique may be a direct effect of an ICS-targeting attack or arise tangentially from an IT-targeting attack against non-segregated environments, and that halted operations can lead to supply shortages and higher prices for end users.
It overlaps with T0826 Loss of Availability, which describes the operator's inability to deliver a product or service. T0828 is the commercial measure of the same events. For the IT-side mechanics, see the MITRE ATT&CK T1486 Data Encrypted for Impact and the ATT&CK Impact Tactic Guide.
What the procedure examples show
| Example (ATT&CK ID) | What ATT&CK records | Route to lost output |
|---|---|---|
| Colonial Pipeline ransomware, 2021 (technique text) | Pipeline unable to transport approximately 2.5 million barrels of fuel per day to the East Coast | IT compromise, precautionary shutdown |
| Australian beverage company, 2020 (technique text) | Ransomware shut down some manufacturing sites, including precautionary halts; temporary product shortages announced | IT compromise, IT-dependent brewing |
| LockerGoga (S0372) | Most of Norsk Hydro's 160 manufacturing locations switched to manual operations during recovery | Ransomware, manual fallback |
| Ryuk (S0446) | An ERP manufacturing server was lost; the shop floor relied on paper and existing orders | Loss of a business system the plant needed |
| NotPetya (S0368) | Disrupted facilities supplying vaccines, halting production | Destructive malware spreading from IT |
| EKANS (S0605) | Temporary production loss within a Honda manufacturing plant | Ransomware |
| REvil (S0496) | Encrypted sensitive files used by OT equipment | Ransomware reaching OT data |
| Bad Rabbit (S0606) | Transportation organisations in Ukraine had computers encrypted, per media reports | Ransomware |
| Conficker (S0608) | Nuclear plant shut down and went through security procedures before returning to production | Commodity malware, mandatory checks |
| Triton Safety Instrumented System Attack (C0030) | A safety controller tripped to a failed safe state, shutting the plant for more than a week | Targeted ICS attack |
| 2015 Ukraine Electric Power Attack (C0028) | Breakers opened; operators could not deliver power for around 6 hours | Targeted ICS attack |
| Unitronics Defacement Campaign (C0031) | CyberAv3ngers caused multiple businesses to halt industrial operations | Internet-exposed controllers |
Reading the beverage case closely
Lion's own updates in June 2020 explain the mechanism. On 9 June Lion shut down its IT systems as a precaution. On 10 June it said the attack had impacted crucial aspects of the brewing process and that its breweries were heavily reliant on IT infrastructure. It warned of temporary shortages on 12 June, reported shortages of packaged and keg brands in Australia on 15 June, and on 26 June said all nine major breweries in Australia and New Zealand were brewing and distributing again. The lost output came from IT dependency, not from an attack on brewing control systems.
A recent large-scale example
The NHI Mgmt Group analysis of the Jaguar Land Rover cyberattack records production halted for more than five weeks from September 2025 after the company proactively shut down its systems, with £196m of incident costs reported for one quarter and a Cyber Monitoring Centre estimate of £1.9bn for the UK economy. The page does not show that plant control systems were directly attacked. This is not an ATT&CK procedure example, but it fits the technique's description of tangential impact from an IT attack.
Detection: the loss is visible, the cause must be found early
ATT&CK v20 attaches detection strategy DET0757 to T0828, and its analytic states that no standard detection method currently exists for this technique. Lost output shows up in production reports. Defensive value lies in detecting the ransomware and intrusion activity that precedes it, and in noticing early that operations are degrading.
- IT-side precursors: ransomware staging, mass credential use and backup deletion on IT systems that OT depends on. See the Ransomware Response and Recovery Guide.
- Boundary signals: new or unusual traffic across the IT and OT boundary, especially file sharing and remote access protocols. See the OT Network Security Monitoring Guide.
- Operational signals: historian data gaps, production orders not reaching the plant, and failures of manufacturing execution or ERP interfaces.
Reducing the exposure
ATT&CK maps one mitigation to T0828: M0953 Data Backup, which calls for hardened backups kept separate from the corporate network, exercised incident response plans, and gold-copy images and configurations for key systems. The procedure examples point to further steps that are about dependency and continuity.
- Price the downtime: for each site and line, estimate lost output and revenue per hour and per day, contractual penalties and restart costs. Use the Business Continuity and Disaster Recovery Guide for the business impact analysis method.
- Map IT dependencies of production: ERP, manufacturing execution, scheduling, labelling, quality and shipping systems. The Ryuk and Lion examples were lost through these, not through control systems.
- Segment IT and OT with a DMZ: the CISA, FBI, EPA and DOE primary OT mitigations call for segmenting critical systems and a DMZ for passing control data to enterprise logistics. See the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.
- Prepare degraded modes: paper or offline order lists, local copies of recipes and schedules, and manual labelling or batch records, so the plant can keep producing while IT is rebuilt.
- Practise manual operation: the same agencies tell operators to practise and maintain the ability to run OT systems manually.
- Protect and test backups: keep offline backups of OT servers, controller logic and the business systems production needs, and test restores against the recovery time the business impact analysis requires. See the OT Backup, Recovery and Golden Image Guide.
Choosing where to invest first
| Finding from the impact analysis | First investment | Trade-off |
|---|---|---|
| Plant cannot run without one IT system | Localise or duplicate that service in the OT zone, or build a manual degraded mode | Extra systems to patch and secure |
| Plant could run but would be stopped as a precaution | Written isolation and continue criteria, plus monitoring good enough to support them | Requires trust in segmentation evidence |
| Restore time far exceeds tolerable downtime | Offline gold images, spare hardware and restore drills | Storage, spares and staff time |
| Single site produces a critical product | Standby capacity or alternative supply arrangements | High cost; a business decision, not only a security one |
A single-site manufacturer should focus on IT dependency removal, offline backups and a degraded paper mode. A multi-site group should also plan for simultaneous loss of all sites through shared IT, which is how the Norsk Hydro and Jaguar Land Rover disruptions spread.
Where identity fits
Shared directories and remote access often carry an IT incident into the plant. Separate OT authentication from the corporate domain where practical, and give vendor and integrator accounts owners, MFA and expiry. The Colonial Pipeline entry point was an unused VPN profile without MFA. See the OT and ICS Identity and Access Guide.
Metrics that show it is working
- Downtime cost coverage: share of production sites with a current business impact analysis that prices downtime.
- IT dependency count: number of IT services each critical line needs to keep producing, trending down.
- Degraded mode readiness: lines with a tested manual or offline operating mode in the last 12 months.
- Restore time against target: measured time to restore the systems production needs, compared with tolerable downtime.
- Shared credential paths: count of accounts valid in both IT and OT environments, trending down.
Framework mapping
| Control area | NIST SP 800-53 Rev 5 | NIST CSF 2.0 | ATT&CK for ICS mitigation |
|---|---|---|---|
| Business impact and dependency analysis | CP-2 Contingency Plan; CM-8 System Component Inventory | GV.OC-04; ID.RA-04 | Not mapped by ATT&CK |
| Backups and restore | CP-9 System Backup; CP-10 System Recovery and Reconstitution | PR.DS-11; RC.RP-01 | M0953 Data Backup |
| Continuity testing | CP-4 Contingency Plan Testing | ID.IM-04 | M0953 Data Backup |
| Resilience in adverse conditions | CP-7 Alternate Processing Site | PR.IR-03 | Not mapped by ATT&CK |
| Incident handling | IR-4 Incident Handling; IR-8 Incident Response Plan | RS.MI-01 | Not mapped by ATT&CK |
For OT tailoring of these controls see NIST SP 800-82 Rev. 3 (final, 28 September 2023) and the NIST SP 800-82 OT Security Guide.
Common failure patterns
- Treating it as an IT problem: the plant's dependence on ERP, scheduling and labelling is not on the OT risk register, so a corporate ransomware incident stops production.
- No price on downtime: without numbers, resilience spending loses to other priorities until after an incident.
- Shared IT across sites: one compromise halts every plant at once.
- Backups that cannot meet the restore target: backups exist but restoring hundreds of hosts takes longer than the business can wait.
- No degraded mode: staff have never run a line on paper, so the option is not real when it is needed.
Practitioner checklist
- Run a business impact analysis that prices downtime per site and line.
- List every IT system production depends on and reduce or localise those dependencies.
- Segment IT and OT with a DMZ and agree written isolation criteria.
- Prepare and test a degraded or manual operating mode for critical lines.
- Keep offline, tested backups of OT systems and the business systems production needs.
- Measure restore times against tolerable downtime and close the gap.
- Separate OT authentication from the corporate domain where practical.
Standards and references
- MITRE ATT&CK for ICS: Loss of Productivity and Revenue (T0828)
- MITRE ATT&CK for ICS: Impact (TA0105)
- NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- CISA, FBI, EPA and DOE: Primary Mitigations to Reduce Cyber Threats to Operational Technology
- CISA: AA23-335A IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors
- Lion: Update on cyber issue (June 2020)
Related NHI Mgmt Group resources: MITRE ATT&CK for ICS Guide · OT Ransomware Response Playbook · OT and Critical Infrastructure Executive Briefing · Business Continuity and Disaster Recovery Guide · MITRE ATT&CK for ICS T0826 Loss of Availability