Between May and July 2026, ransomware stopped production at West Pharmaceutical, at Foxconn factories in North America, at two Mackay Sugar mills and at Coca-Cola's fairlife dairy plants. In the second quarter alone, Dragos counted 747 ransomware incidents against manufacturers: 65% of all the industrial cases it tracked. Black Kite counted 1,183 disclosed manufacturing victims in the first seven months of the year.
This briefing for manufacturing CEOs, CTOs and CISOs covers five verified attacks, how the crews think, the control that breaks each move, and where Cyron Intelligence fits.
The short version
- The plant stops because IT stops. Dragos found no Q2 2026 case where attackers manipulated a control system. Encrypting ERP, hypervisors and identity systems was enough.
- The way in is ordinary. An unpatched VPN or firewall, a login without MFA, or a fake download of an IT tool.
- Theft comes first. Crews copy your data before they encrypt it, so backups alone don't end the extortion.
- Paying is not a plan. Recovery took fairlife 11 days and Asahi about two months. One gang's encryptor corrupts its own key, so paying recovers nothing.
Five attacks, one pattern
Asahi Group · beverages, Japan
The attackers entered through network equipment at a Group site and reached the data centre network. Ransomware hit multiple servers and PCs at once. Shipments resumed in stages over about two months, and personal data of up to 1.9 million people may have been exposed.
Foxconn · electronics, North America
Some North American factories were hit. A Wisconsin employee described being sent home during network outages, with work falling back to pen and paper. Nitrogen claimed 8 TB and 11 million files, including technical files from other technology companies.
West Pharmaceutical · injectable-drug components, global
Data was stolen and systems were encrypted. West took systems offline globally to contain the attack, then restarted shipping, receiving and manufacturing site by site.
Mackay Sugar · Australia's second-largest raw sugar producer
Two of its three mills shut just after the crushing season began, halting harvesting across much of the Mackay region. A limited manual crush restarted at one mill two days later.
fairlife (Coca-Cola) · dairy, United States
Ransomware reached production-related systems and US production was suspended. The majority of production at its four US plants resumed 11 days later. Some data was taken.
Look at what failed. Not robots, and not PLCs. Dragos reviewed the industrial ransomware cases it saw in Q2 2026 and found no case where an operator reached the control-system stage. Where production stopped, it followed “encryption or precautionary shutdown of the enterprise and virtualization systems on which OT depends”.
Note the word precautionary. West and Asahi cut off their own systems to contain the attack, and that was the right call. But if a plant cannot run without ERP, containment itself stops the line.
Think like the attacker
A ransomware crew runs a business. It picks targets the way an investor picks deals: the biggest payout for the least effort. Manufacturers score well on both.
- Downtime is the lever. Every idle hour costs money, so the pressure to pay grows by the hour. Mackay Sugar was hit just after the crushing season started, when harvested cane cannot wait.
- Your customers' secrets are a second lever. Nitrogen claimed technical files from other technology companies in the Foxconn haul. That puts pressure on you and on them.
- Office and plant often share one network. One foothold in IT can reach every system the plant depends on.
- Edge devices are under-watched. A firewall or VPN appliance can't run your EDR agent, and its patches often wait for a maintenance window.
If a crew wrote its plan on one line, it would read like this:
“I don't need your robots. I need one VPN login without MFA, a quiet weekend and your hypervisors. Then I sell you back your Monday.”
Five moves, and the control that breaks each one
Of the five companies, only Asahi has published how the attackers got in. What follows is what researchers documented for the groups involved, and the controls that stop each move. Fundamentals stop most crews. The advanced controls are for when you are already a target, and if you make things, you are.
1. Get in
MoveExploit or log in to an internet-facing device. Dragos saw The Gentlemen consistently target Fortinet FortiGate and Cisco edge devices and, in one case, Akira walk in through a legacy VPN account without MFA. Group-IB documented The Gentlemen exploiting a FortiOS authentication bypass (CVE-2024-55591) and brute-forcing about 1,000 Fortinet VPNs. Nitrogen buys search ads that lead IT staff to fake installers of tools such as WinSCP, PuTTY and Advanced IP Scanner.
FundamentalsKeep a live list of every internet-facing device. Patch anything on CISA's Known Exploited Vulnerabilities catalog within days, not at the next maintenance window. Put MFA on every VPN account, including suppliers'. Delete dormant accounts. Install software only from an internal catalogue.
AdvancedPhishing-resistant MFA (FIDO2 keys) for admins and remote access. Per-application access instead of network-wide VPN. After every edge-device advisory, hunt for new local admin accounts and changed configurations: Group-IB saw The Gentlemen plant accounts with names such as “support_fortinet”.
2. Become admin
MoveSteal credentials and map Active Directory until they hold domain admin. Abuse of valid accounts and credential theft run through Dragos's Q2 2026 findings.
FundamentalsSeparate admin accounts from everyday accounts. Unique local admin passwords with Windows LAPS. No domain-admin logins on ordinary PCs.
AdvancedTiered administration. Enforce SMB and LDAP signing to break relay attacks. Alert on any new domain admin or Group Policy change.
3. Blind the defenders
MoveLoad a vulnerable kernel driver and use it to kill security tools. ESET found that The Gentlemen's GentleKiller targets more than 400 processes across 48 security products.
FundamentalsEDR on every server, with tamper protection on. Treat an agent that goes silent as an incident, not a ticket.
AdvancedEnforce Microsoft's vulnerable driver blocklist. Watch around the clock, with your own team or a managed detection and response provider.
4. Steal the data
MoveCopy ERP records, designs and HR files out before encrypting anything. West and fairlife both confirmed data was taken, and Nitrogen claimed 8 TB from Foxconn.
FundamentalsBlock outbound internet from servers by default. Alert on bulk-transfer tools such as Rclone and on uploads to file-sharing services.
AdvancedBaseline the data flows of your ERP, PLM and supplier APIs, and block abnormal bulk pulls as they happen.
5. Stop the plant
MoveEncrypt hypervisors, ERP and file servers at once, then extort twice: pay to decrypt, and pay again to keep the data private. At Asahi, ransomware hit multiple servers and PCs simultaneously.
FundamentalsImmutable, offline backups of Active Directory, hypervisors, ERP and MES. Time a full restore every quarter. Separate IT and OT, with one controlled path between them.
AdvancedIEC 62443 zones and conduits. An “island mode” that lets each plant run for days without ERP. Rehearsed manual operation: Mackay Sugar restarted a manual crush within two days. Hardened ESXi: lockdown mode, with hosts kept off the corporate domain.
When it happens anyway: the first 72 hours
- Isolate, don't wipe. Asahi disconnected its network and isolated the data centre about four hours after the disruption began. Keep encrypted systems, memory and logs: they are your evidence.
- Find the way in before you restore. Otherwise you restore the attacker too. As West restarted, it cited an assurance letter from Unit 42 confirming that malicious binaries and persistence mechanisms had been neutralised.
- Scope the theft. What left, by which route, and whose data it was decides who you must notify.
- Report on the clock. NIS2 requires an early warning within 24 hours and an incident notification within 72. US-listed companies must file a Form 8-K within four business days of deciding an incident is material.
- Restore in dependency order. Identity first, then hypervisors, then ERP and MES, then the plant.
- Don't count on a decryptor. Coveware found that Nitrogen's ESXi encryptor corrupts its own public key. Those files cannot be decrypted by anyone, paid or not.
Where Cyron Intelligence helps
We build runtime security and run focused assessments. Here is where that fits against ransomware, and where it doesn't.
Before: find the gap first
Our security posture assessment maps your real attack surface across applications, APIs, cloud and identity, and ranks findings by exploitability and impact, not raw CVSS. For a manufacturer, it answers the questions in this article: which edge devices are exposed, which remote accounts lack MFA, how far the office network reaches toward the plant, and which IT systems would stop a line if they failed.
Continuous advisory keeps that current for teams without a full security function, and we turn NIS2 and ISO 27001 into measures your engineers can work through. Germany's NIS2 act, in force since 6 December 2025, makes management liable for culpable breaches.
During: catch the theft
Crews steal before they encrypt, and much of what a manufacturer holds sits behind APIs: ERP, MES, PLM and supplier portals. Cyron API Security watches that traffic from the Linux kernel with eBPF, out of band, so it adds nothing to your production path. It flags abnormal data pulls and data leaking through API responses, finds endpoints nobody documented, and blocks the source at the kernel. Signed, OCSF-aligned events go to your SIEM.
If you are connecting AI agents to ERP or maintenance systems, Cyron AI Security inspects what those agents send to their tools and to each other. It catches secrets in tool arguments and data moving between tool servers, and it runs fully air-gapped, which suits plant networks.
After: prove what happened
Regulators, insurers and customers will ask what left and how. Cyron API Security keeps the traffic it analyses so incidents can be investigated, and its forensic reports explain what happened in terms a person can act on. Before you reconnect, a fresh posture assessment confirms the entry point is closed and the same path isn't open somewhere else.
What we don't replace: endpoint protection, immutable backups and a 24/7 incident response retainer. You need all three, and our assessment will tell you plainly which you are missing.
Five questions for your next board meeting
- Which of our internet-facing devices has a known exploited vulnerability today, and how fast did we patch the last one?
- Does every remote access account have MFA, including supplier and contractor accounts?
- If ERP and our hypervisors were encrypted tonight, how many hours could each plant keep running?
- When did we last restore Active Directory and ERP from backup, and how long did it take?
- Could we tell a regulator within 24 hours what data left, and by which route?