Ransomware on the Shop Floor: Why Manufacturers Are a Favorite Target

A 90-person machine shop comes in on Monday to find the scheduling system encrypted and a ransom note on the front office printers. The CNC machines still power on, but nobody can pull job files, print travelers or see which orders ship this week. By noon the plant manager is deciding whether to send the second shift home.

That scene is common in manufacturing because the attackers know exactly how much a stopped line hurts. This post covers why manufacturers at this size get targeted so often, what an attack actually costs, and the specific controls that keep a ransomware incident in the office instead of on the shop floor.

Manufacturing has topped the target list for five years

Manufacturing is not a niche target. IBM's 2026 X-Force Threat Intelligence Index, built on its incident response work during 2025, ranked manufacturing the most attacked industry for the fifth year in a row, at 27.7% of incidents in its top industries. Exploitation of public-facing applications was the most common way in for manufacturing incidents, at 32%.

The FBI sees the same pattern in U.S. complaints. The FBI Internet Crime Complaint Center's 2025 report logged 3,611 ransomware complaints, up from 3,156 the year before, and critical manufacturing ranked among the critical infrastructure sectors most often hit.

Size does not protect smaller plants. Verizon's 2025 Data Breach Investigations Report found ransomware in 88% of breaches at small and mid-sized organizations, compared with 39% at larger ones. Large companies have more incidents of other kinds. Smaller ones mostly get the kind that stops work.

Why attackers like manufacturers

Ransomware groups are businesses. They pick targets where the odds of getting paid are high and the defenses are thin. Manufacturers at the 25-200 employee range tend to hit both conditions.

Downtime is immediately expensive. A law firm with encrypted files can still take calls and work from email for a day. A plant that can't run its ERP, MES or scheduling system often can't build, pick, pack or ship. Every hour shows up on the delivery calendar, and customers with just-in-time supply chains notice within days. Attackers count on that pressure to push a fast payment.

Old systems run critical work. Shop floors routinely run machine controllers, HMIs and quality stations on operating systems the vendor stopped patching years ago. They stay because the equipment works and replacing the control PC can mean recertifying the machine. Those systems are hard to protect with ordinary endpoint tools and easy to reach once an attacker is inside the network.

The office and the floor share a network. In many smaller plants, the front office, the engineering workstations and the machines sit on one flat network. Ransomware that starts with a phishing email in accounting can reach the shop floor without crossing a single barrier.

Remote access piles up. Equipment vendors, integrators and the ERP provider often have their own remote access tools, set up years ago for a support call and never removed. Each one is a door, and some still use shared or default passwords. CISA, the FBI, the EPA and the Department of Energy called out exactly this in their May 2025 fact sheet on primary mitigations for operational technology.

Security is nobody's full-time job. The IT provider keeps the servers and laptops running. The maintenance team keeps the machines running. Nobody is watching the network at 2 a.m. on a Saturday.

What it costs when the line stops

The ransom is usually not the biggest number. Verizon's 2025 report put the median ransom payment at $115,000, and 64% of victims declined to pay. The larger costs come from lost production, recovery labor, overtime to catch up, expedited freight and customer penalties for late delivery.

IBM's Cost of a Data Breach Report 2025 put the average breach in the industrial sector at $5.00 million, above the $4.44 million global average across all industries. Those figures skew toward larger organizations, so treat them as a ceiling rather than a forecast for a 90-person plant. The more useful number is your own.

A simple way to size it: take the gross margin on a normal day's shipments, multiply by the number of days a full rebuild would take, then add recovery labor and any contractual penalties. A plant that ships $60,000 of product a day at a 30% gross margin loses about $18,000 in margin for every day nothing ships, before overtime, freight or a single invoice from an incident response firm. Five days down is $90,000 in margin alone, and that assumes every customer waits.

There are costs that don't show up in that math. A customer that had to slow its own line because your parts didn't arrive may move volume to a second source. Defense and aerospace customers will ask hard questions about how their drawings and technical data were handled. Insurers will look closely at which controls were actually in place on the day of the attack.

The controls that keep ransomware off the floor

None of this requires a security operations center on site. It requires a short list of controls, set up correctly and watched continuously.

Control	What it prevents	Typical gap at a small plant
Multi-factor sign-in on email and remote access	Stolen passwords opening the door	Vendor and admin accounts left out
Network separation between office and floor	Office infection spreading to machines	One flat network for everything
Application allowlisting on office and control PCs	Unapproved programs, including ransomware, running	Only basic antivirus installed
Offline or immutable backups, tested	Paying to get data back	Backups on the same network, never restored
Continuous monitoring and response	Overnight encryption going unnoticed	Alerts go to an inbox nobody reads at night
Vendor remote access review	Forgotten tools used as a way in	No list of who can connect

A few of these are worth expanding.

Separate the floor from the office. CISA's operational technology guidance lists segmenting IT and OT networks as one of five primary mitigations, alongside removing OT from the public internet, changing default passwords, securing remote access and keeping the ability to run processes manually. At a small plant, separation can be as straightforward as a firewall rule set that only lets the scheduling server talk to the machines it needs, and nothing else. It doesn't need to be perfect to stop an infection that starts in accounting.

Protect what can't be patched. For control PCs that can't be updated, the answer is to limit what can reach them and what can run on them. Application allowlisting, which only allows approved software to execute, works well on machines whose job never changes. A control PC that runs one program should only ever run that program.

Control vendor access. Make a list of every outside party that can connect remotely. Remove the ones nobody uses. Put the rest behind multi-factor sign-in and turn access on only when a support session is scheduled.

Back up the things production depends on. Most plants back up the ERP. Fewer back up machine programs, PLC logic, HMI configurations and quality records, which are often the slowest things to rebuild. Keep at least one copy offline or immutable, and restore from it on a schedule so you know how long a rebuild really takes. CISA's #StopRansomware Guide covers backup and recovery planning in plain terms.

Practice running without the network. Decide in advance which jobs can run from paper travelers and locally stored programs if the scheduling system is down. A plant that can keep shipping its top customers' orders at reduced speed is in a much stronger position than one that can only wait.

What responding to an attack looks like

When ransomware starts running, the first hour matters. Good response is calm and procedural: isolate the affected machines from the network, cut off the attacker's access, protect the backups, preserve evidence for the insurer, and decide what production can safely continue.

The critical part is detection speed. Ransomware crews often spend time inside a network before they encrypt anything, moving between machines and disabling backups. Monitoring that catches that activity, such as a new admin account at 3 a.m. or a backup job being deleted, turns a plant-wide shutdown into a contained incident on a few machines. For a step-by-step view of how that works, see what happens when we detect a threat.

Example engagement: a 75-person metal fabricator runs its office, engineering and shop floor on one network, and two equipment vendors have permanent remote access through tools set up years ago. Elevaire would map every device and remote connection, work with the fabricator's IT provider to separate the floor from the office, put allowlisting on the control PCs, remove the unused vendor tool and add multi-factor sign-in to the other, and confirm that machine programs are included in the offline backups. On the Plus package, Elevaire's team would then watch for intrusion activity around the clock and step in to contain it.

How Elevaire handles this for manufacturers

Elevaire Managed Security runs a manufacturer's security end to end: it manages the security tools and vendors, watches for threats, and steps in when an attack hits. That includes ransomware and application allowlisting, email security, multi-factor sign-in and access hardening, device management, security training and phishing tests, and a quarterly security review. The Plus and Complete packages add 24/7 detection and response, backup and vulnerability scanning. Essentials provides business-hours response.

Elevaire works alongside the plant's existing IT provider or internal IT person rather than replacing them. The IT provider keeps the servers, laptops and ERP running. Elevaire owns the security side and coordinates with equipment vendors on remote access and control systems. For plants with defense customers, the same work feeds directly into the compliance readiness projects those contracts increasingly require. More on how this applies across the sector is on our manufacturing and supply chain page.

Frequently Asked Questions

Why do hackers target small manufacturing companies?

Manufacturers lose money fast when production stops, which makes them more likely to pay a ransom quickly. Smaller plants also tend to have older control systems, flat networks and vendor remote access that nobody monitors. IBM's 2026 X-Force report ranked manufacturing the most attacked industry for the fifth straight year.

How much does a ransomware attack cost a manufacturer?

IBM's 2025 Cost of a Data Breach Report put the average industrial-sector breach at $5.00 million, though that figure skews toward large companies. For a smaller plant, the biggest cost is usually lost production: daily gross margin multiplied by the days it takes to recover, plus recovery labor, overtime and late-delivery penalties. Elevaire's managed security runs on predictable monthly pricing with no hourly billing, so prevention is a fixed cost rather than an open-ended recovery bill.

Can ransomware spread from office computers to shop floor machines?

Yes, when the office and the shop floor share a network, which is common at smaller plants. Separating the two with firewall rules so only specific systems can talk to the machines stops most infections from crossing over. CISA lists IT and OT network segmentation as one of its five primary mitigations for operational technology.

Does Elevaire replace our current IT provider?

No. Elevaire works alongside your existing IT provider or internal IT staff. They keep day-to-day systems running, and Elevaire handles security: monitoring, response, access hardening, backups and vendor remote access. For plants with no IT support at all, the Complete package adds help desk through a vetted IT partner.

What should a manufacturer do first to reduce ransomware risk?

Start with three things: turn on multi-factor sign-in for email and every remote access tool, list and remove vendor remote access nobody uses, and confirm you have an offline backup that includes machine programs and PLC logic. Then plan network separation between the office and the floor. A short security assessment can rank the rest by risk to production.