Manufacturing faces halted production as OT cyber attacks surge to 17% in 2025

Manufacturing organisations face a heightened threat landscape as cyber attacks against the sector increased significantly in 2025. According to research published by Huntress, the industry accounted for approximately 17% of all cyber attacks that year, a sharp rise from 9% in the previous year. This surge indicates that threat actors are increasingly targeting the operational core of manufacturing businesses rather than just their administrative data.

Which systems and data are under threat?

Threat actors are prioritising operational technology (OT) systems over traditional data repositories because halting production causes immediate financial damage. Attackers aim to disrupt assembly lines, which can lead to missed shipments, contract penalties, and idle labour costs. Additionally, sudden shutdowns of OT systems pose safety risks by potentially damaging sensitive equipment or creating hazardous conditions for staff on factory floors.

How are attackers gaining access to production environments?

The integration of smart factory technologies has removed the traditional air gaps between corporate networks and industrial control systems (ICS). Threat actors often begin with a phishing email to departments such as Sales or Finance, gaining a foothold on standard corporate laptops. From there, they scan for bridges to manufacturing systems, such as vendor VPN appliances or jump servers, to move laterally into the OT environment.

Why are industrial control systems vulnerable now?

Many industrial control systems and Industrial Internet of Things (IIoT) sensors were not designed with modern security in mind and are now connected to the internet or corporate networks for remote maintenance and monitoring. Without strict network segmentation, stolen credentials from office systems can allow attackers to access programmable logic controllers (PLCs) and human-machine interfaces (HMIs), enabling them to alter recipe values or disable safety sensors.

What is the recommended security approach?

Huntress highlights the adoption of Zero Trust architecture as a critical trend for securing modern plants. This approach assumes that every connection, whether from a laptop, vendor, or sensor, could be a potential threat until proven otherwise. By implementing multiple layers of defence and strict boundaries between office and plant networks, organisations can prevent a breach in one area from leading to a shutdown on the assembly line.

What affected people can do

Teams should verify that network segmentation strictly separates corporate IT environments from operational technology systems. Employees must remain vigilant against phishing attempts, as these are often the initial entry point for attackers seeking to reach production networks. Organisations should review access controls for remote maintenance tools and ensure that industrial sensors and control systems are not directly exposed to unsecured networks. Monitoring for unusual lateral movement within the network is essential to detect early signs of intrusion.

Background: Network segmentation

Network segmentation divides a network into smaller, isolated zones using firewalls and access controls. This limits lateral movement by attackers. You achieve this by grouping devices by function, enforcing strict access rules, and verifying that traffic between zones is explicitly allowed. This stops a single breach from becoming a total outage.

Read the full guide: Network segmentation examples: how to isolate threats and limit damage

What to do and how to stay safe: Huntress

• Implement strict network segmentation to isolate operational technology from corporate IT networks.
• Enforce Zero Trust principles by verifying every connection and device before granting access to critical systems.
• Monitor for unusual activity on jump servers and VPN appliances that could indicate lateral movement.
• Train staff in non-financial departments to recognise phishing attempts that serve as initial footholds for attackers.

Step-by-step guide: Offline Backups Checklist: Verify Air-Gaps and Recovery Speed

General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How much did manufacturing cyber attacks increase in 2025?

Manufacturing accounted for 17% of cyber attacks in 2025, an increase from 9% in 2024, according to Huntress.

What is the primary target of ransomware attacks in manufacturing?

Attackers are targeting operational technology (OT) systems to halt production and cause financial damage, rather than just stealing data.

How do attackers move from office networks to factory floors?

Attackers use compromised office credentials to scan for bridges like VPN appliances or jump servers, allowing them to hop into OT environments without strict segmentation.