Yes — manufacturing ransomware can shut a factory without ever touching a PLC. Dragos logged 1,140 industrial ransomware incidents in Q2 2026; 747 hit manufacturers, and not one involved control-system compromise. Encrypting ERP, virtualization, and identity systems was enough to halt production.
What did the Dragos Q2 2026 report reveal about manufacturing ransomware?
Dragos, an industrial-cybersecurity firm, published its Q2 2026 industrial ransomware report on August 10, 2026 (summarized by Help Net Security on August 11). It counted 1,140 ransomware incidents against industrial organizations last quarter — up 12% from 1,020 the quarter before. Manufacturing absorbed 747 of them, about 65% of every incident tracked. The single most important number is the one that stayed at zero. It reframes manufacturing ransomware as an IT-availability problem, not a control-system one.
| Metric | Q2 2026 (Dragos) |
|---|---|
| Total industrial ransomware incidents | 1,140 (up 12% from 1,020 in Q1) |
| Manufacturing victims | 747 (~65% of all incidents) |
| Incidents reaching control systems (Stage 2, ICS Cyber Kill Chain) | 0 |
| United States incidents | 431 (38% of global) |
| Most active group — Qilin | 140 incidents |
| Akira | 129 incidents |
| The Gentlemen | 125 incidents |
Dragos also flagged an emerging entry vector worth naming: attackers posing as internal IT over Microsoft Teams, talking an employee into granting remote access. We break that lure down in how fake IT-support calls on Teams lead to ransomware — it is how several of these enterprise-side compromises started.
How does ransomware stop production without touching your PLCs?
This is the defining trait of modern manufacturing ransomware. Here is the finding that should reframe how a plant thinks about risk: in zero of those 1,140 incidents did operators reach Stage 2 of the ICS Cyber Kill Chain — the stage where an attacker actually manipulates control-system logic. The PLCs, the robots, the machine controllers were never the target and never had to be. The production stoppage came entirely from the enterprise IT and virtualization layer. Four systems do most of the damage when they go dark:
- ERP — without it, you can’t release work orders, ship, or bill; the line has nothing to run.
- Hypervisors — encrypt the virtualization host and dozens of production-support servers vanish at once.
- Active Directory / identity — if no one can log in, no one can operate anything.
- Remote-access gateways — the VPNs and jump hosts your team and vendors depend on to reach any of it.
There is a second way production stops even when the malware never spreads that far: the precautionary shutdown. When a company can’t yet prove the infection stayed on the IT side, it pulls the line down on purpose to protect it. Mackay Sugar saw milling disrupted without attackers ever reaching control systems; West Pharmaceutical executed a precautionary global shutdown. The decision to stop is a business call, and it costs the same as a real breach.
The clearest recent example is Fairlife, the Coca-Cola-owned dairy brand. In an 8-K filed July 16, 2026, the company disclosed that attackers accessed “production-related systems” (its exact phrasing) and that it temporarily suspended US production; Canadian operations were unaffected. The Anubis group claimed the attack on July 20, and the majority of US production resumed around July 28 — roughly 12 days down. Whether operational technology was actually compromised is unconfirmed; the 8-K says production-related systems, not control systems. That distinction matters, and it is the whole point: your IT is the shutdown path. (Internet-exposed PLCs are a separate, real exposure — the inverse problem — covered in our write-up of the CISA advisory on internet-exposed PLCs.)
Why isn’t IT/OT segmentation enough on its own?
Segmentation is essential — it limits the blast radius, keeping a compromised office PC from reaching the shop floor — but on its own it does not keep the plant running, because the systems production actually depends on live on the IT side of that boundary. Wall off the OT perfectly and an encrypted ERP or hypervisor still stops the line. Segmentation shrinks how far an attack spreads; it does nothing for the enterprise systems the attack already reached. We cover the boundary itself in depth in IT/OT network segmentation for manufacturers; here the point is narrower — it is one layer, not the whole answer. Against manufacturing ransomware, segmentation is necessary but never sufficient.
What actually keeps a plant running: the three layers
Continuity against manufacturing ransomware is three layers working together. No single one is sufficient — the table below is deliberately honest about what each layer can’t do alone. Skip any one layer and manufacturing ransomware still finds the gap.
| Layer | What it does | What it can’t do on its own |
|---|---|---|
| IT/OT segmentation | Limits how far an IT infection spreads toward the plant floor; keeps a compromised office PC off the production network. | Won’t keep the line running if the ERP, identity, or virtualization it depends on is encrypted — the boundary still sits on IT. |
| Tested, immutable backups + defined RTO/RPO | Restores encrypted enterprise systems on a clock you chose, not the attacker’s; immutable copies survive an attacker who reaches your backups. | A backup you’ve never restored is a guess; without a per-line RTO you can’t say how long production stays down. |
| Rehearsed incident response | A written, practiced who-calls-whom that cuts the decision lag when the line stops. | Can’t recover data it has no backup to restore; can’t invent segmentation that was never built. |
What should a small manufacturer do first?
You don’t need a six-figure program to survive manufacturing ransomware. You need to know your dependencies and prove your recovery. Five moves, in order:
- Map which IT systems production depends on. List every enterprise system a line needs to run — ERP, identity, the virtualization host, remote access. If it going dark stops a machine, it’s on the list.
- Set an RTO per line. Decide, per production line, how long you can afford to be down. That number drives every decision below.
- Move to immutable or offline backups. Copies an attacker who owns your network still can’t alter or delete — that is what turns a breach into a bad day instead of a closure.
- Test one restore this quarter. Actually recover one mapped system end to end and time it against your RTO. An untested backup is a hope, not a control.
- Write the who-calls-whom page. One page: who declares an incident, who calls the insurer and counsel, who owns the shutdown decision. Decide it now, not at 2 a.m. with the line down.
What we cover — and what we don’t
We’ll be plain about our lane. QOS MSP secures the IT that production depends on — the enterprise systems, the identity layer, the IT/OT boundary, endpoint and network monitoring, backups, and the recovery when something gets through. That is exactly the layer manufacturing ransomware is hitting, and it is what our security administration service manages day to day. BCDR is included at every tier — designing the continuity approach, agreeing RTO/RPO, testing restores, running the recovery — though the redundant infrastructure continuity runs on (a second site, standby cloud capacity, backup storage) is billed separately, because we administer it, we don’t resell it. Either way, manufacturing ransomware defense lives in that IT layer, and that is the layer we run.
What we don’t do: run your MES, program your PLCs, or maintain your machine-vendor software. Your controls integrator stays in that loop — and should. If your only exposure is a handful of standalone machines with no enterprise systems tying them together, and you already test offline backups, you may not need us yet. But the moment production depends on shared IT — and for 747 manufacturers last quarter, it did — the shutdown path runs straight through the layer we cover. Talk to us and we’ll map your dependencies before an attacker does.
Frequently asked questions
Can ransomware shut down a factory without hacking the PLCs?
Yes. In Dragos’s Q2 2026 data, zero of 1,140 industrial ransomware incidents reached control systems, yet 747 manufacturers were hit. Production stopped because attackers encrypted enterprise IT — ERP, virtualization, and identity — or because the company shut the line down precautionarily.
Which IT systems most often halt production when they are encrypted?
Four do most of the damage: ERP, virtualization hosts (hypervisors), Active Directory or identity, and remote-access gateways. Any one going dark can stop a line even when the machines themselves are untouched. Companies also shut production down on purpose when they cannot yet prove the infection stayed on the IT side.
Is IT/OT segmentation enough to prevent a production shutdown?
No. Segmentation limits how far an infection spreads, but the systems production depends on live on the IT side of that boundary, so an encrypted ERP or hypervisor still stops the line. Continuity needs segmentation plus tested immutable backups, a defined RTO and RPO, and a rehearsed incident response.
How long does production stay down after a ransomware attack?
Weeks is normal. Fairlife took roughly 12 days to resume the majority of US production after its July 2026 incident, and it is a large, well-resourced company. Your real answer is whatever restore time you have actually tested — an untested backup gives you a hope, not a recovery clock.
Do small and mid-size manufacturers actually get targeted?
Yes. Manufacturing took 747 ransomware incidents in a single quarter, and most never make the news. Groups like Akira and Qilin work the mid-market deliberately, because smaller plants often have flat networks and untested backups. Size is not protection here.
