Summary: Manufacturing remains the top ransomware target, and mid-market companies take the brunt of the attacks. An attack stops production, so the leaders who own uptime now mitigate a large share of the risk. Manufacturers making progress assign clear ownership and hire operations and, and select engineering leaders, who've protected live production environments.
Manufacturing has been the most targeted industry for ransomware five years in a row. From April 2025 through March 2026, manufacturers accounted for 22% of all publicly reported ransomware victims. Manufacturing ransomware attacks show no signs of slowing down.
The surprise is which manufacturers are getting hit hardest. About seven in 10 victims are mid-market companies with $10-$100 million in annual revenue.
Some of the core challenges include plants where:
- Cybersecurity falls into a gray area
- Corporate IT understands network security but may not know the equipment running the production line
- Controls engineers know that equipment inside and out but have limited experience securing the networks connected to it
Here's what's driving manufacturing ransomware attacks, why plant security is now a leadership issue, and what to look for when you hire those leaders.
How common are manufacturing ransomware attacks?
Manufacturing ransomware attacks have risen every year since 2022. Black Kite, a third-party cyber risk firm, counted 1,183 manufacturing victims from January through July 2026, up 39.7% from 847 in the same period of 2025. In just seven months, the count passed the full-year totals for both 2023 and 2024.
The U.S. still has more reported manufacturing victims than any other region. American manufacturers accounted for 412 cases in those seven months, roughly in line with 2025. Europe, meanwhile, saw an 85% increase. Even with U.S. numbers holding steady, the risk isn't going away. Attacks remain elevated at home while spreading faster elsewhere.
Some segments are seeing even sharper increases. Worldwide, ransomware victims in electrical equipment manufacturing nearly doubled, rising 96.6%. Computer and electronics manufacturing wasn't far behind, with a 90.5% increase, according to Industrial Cyber's summary of the report. The typical victim isn't a massive corporation, either. The median-affected manufacturer brings in $42.9 million in annual revenue.
Why are manufacturers such a big ransomware target?
Manufacturers are attractive targets because downtime is expensive. A stopped line means revenue stops with it. Orders fall behind, deliveries get delayed, and customers start asking questions. That pressure can make paying a ransom look like the fastest way to get operations back online.
Ferhat Dikbiyik of Black Kite summed it up well: "What makes manufacturing and distribution so attractive to ransomware operators is the immediate operational impact."
Getting in doesn't always take a sophisticated attack. Often the weaknesses are already there. A Black Kite review of the 1,000 largest manufacturers found that about 70% had employee or system credentials exposed on the dark web. Roughly half had remote-access ports open to the internet. Those weaknesses have shown little improvement in recent years.
Suppliers create another point of vulnerability. Mid-sized manufacturers often supply larger companies, so an attack on one business can ripple across an entire supply chain. A manufacturer might have solid internal protections and still be exposed through a vendor with weaker security.
The growing connection between IT and the plant floor adds to the risk. Production equipment that once ran on isolated networks is increasingly tied to ERP systems, remote monitoring tools, and vendor support platforms. These connections, often called IT and OT convergence, make operations more efficient. They can also give attackers more ways to reach industrial systems. OT, or operational technology, includes the programmable logic controllers (PLCs), operator screens, and supervisory systems that keep production equipment running.
In Fortinet's 2026 survey of more than 700 OT professionals, mostly at large manufacturers and energy companies, 46% said an intrusion had caused an outage that affected revenue. For manufacturers, ransomware is an operational risk that can hit production, customer relationships, and the bottom line.
Why is plant cybersecurity now an operations and engineering issue?
The people responsible for network security and the people responsible for keeping production running often have very different backgrounds. Corporate IT focuses on protecting data and systems. Plant operations focus on keeping equipment running safely and consistently. Those priorities overlap, but they aren't interchangeable. A routine software update or network scan in an office could fault a controller or stop a packaging line mid-run.
Many IT professionals have little hands-on experience with industrial protocols such as Modbus, Profinet, or EtherNet/IP. Controls engineers know those systems well but may have limited training in network segmentation and access control. Walling off production equipment from business systems without disrupting the operation takes both.
For most mid-market manufacturers, the practical answer is to hire engineering and operations leaders who understand enough about network risk to make good decisions. These leaders decide which equipment gets connected, which vendors get remote access, and how fast a line comes back after an outage. They also need to work well with IT or an outside security partner.
That combination is rare, and it's one reason engineering leadership roles in plants are getting harder to define. Leaders who have these skills often come up through controls engineering, system integrators, utilities, water treatment, pharmaceutical manufacturing, or defense suppliers. Few of them are job hunting.
What to look for:
- Technical depth: Hands-on experience with the PLCs, operator interfaces, and control systems in your facilities
- Risk judgment: A record of approving equipment connections, remote access, and changes with security in mind
- Uptime discipline: The ability to schedule security work around production without putting safety or delivery at risk
- Credibility: Trust from IT, outside security partners, and the plant floor
A good test question: "Who could tell us which production controllers are reachable from our business network, and how would they verify it?"
If there’s no confident answer, it may point to a leadership gap that needs attention.
How are compliance and ownership raising the bar for plant security?
For many mid-market manufacturers, plant cybersecurity has been an extra job for the maintenance manager, a plant engineer, or the IT person who covers the plant. Customers and regulators are making that approach harder to maintain.
Defense suppliers feel it first. The Pentagon's Cybersecurity Maturity Model Certification (CMMC) program began requiring self-assessments in November 2025. In July 2026, the Pentagon paused the move to third-party certification while it reviewed the cost to contractors. The underlying security requirements still apply, and a senior executive must affirm compliance every year.
Manufacturers outside defense face similar expectations from customers. The National Institute of Standards and Technology (NIST) publishes a guide to OT security that can help companies set the right protections. Large customers may look to frameworks like it when evaluating suppliers.
Ownership is shifting too. Fortinet's survey found that 81% of respondents planned to move OT security under the chief information security officer (CISO) within a year. Many mid-market manufacturers don't have a dedicated CISO. In those businesses, responsibility often falls to a VP of Operations, a plant leader, an IT director, or several people who each handle part of the job. Without one accountable leader, gaps can go unnoticed.
What to look for:
-
Ownership: One operations or engineering leader accountable for production network risk, with authority across IT and the plant
-
Documentation: A leader who makes sure production assets, access, and controls are documented well enough for customer audits and compliance reviews
-
Communication: A leader who can explain cyber risk in terms of downtime, late shipments, and financial impact
Which leadership roles help manufacturers reduce ransomware risk?
Most mid-market manufacturers don't have the budget (or the need) for a large cybersecurity team, so the leaders they already rely on carry more of the load. Five roles shape how well a plant prevents and recovers from an attack.
-
Controls or automation engineering manager: Owns PLC programs, backups, and change control. In a ransomware event, this is the person who knows what "good" looks like and can bring lines back safely.
-
VP of Engineering: Decides how new equipment gets connected, which vendors get remote access, and what standards new lines have to meet.
-
Plant manager or VP of Operations: Treats cyber risk as downtime risk, makes room for patching windows, and has a recovery plan ready before it's needed.
-
Supply chain or procurement leader: Sets security expectations for suppliers and vendors, which matters when a vendor list is part of the attack surface.
-
COO or CEO: In companies without a CISO, the leader is ultimately accountable for the risk and for funding the fix.
Dedicated security specialists still matter. Larger plants often add an OT security engineer or work with an outside partner. The leaders above decide whether those specialists get the access, priority, and production time they need.
When conducting interviews, ask candidates about a time they changed how equipment was connected, handled a vendor's remote-access request, or brought a line back after an outage. Leaders who've done it tend to answer with specifics. As plants add more connected equipment and AI on the manufacturing floor, that experience becomes part of the job.
Additionally, the line between IT and the plant floor is blurring in how we search. For example, with a reliability engineering role, look at site reliability, DevOps, and systems engineers from IT, next to maintenance, plant, and process engineers. Reliability work runs on sensor data and predictive maintenance, so the skills overlap more than they used to.
It also helps to diagnose the real gap on your team before writing the job description. A rushed hire into a role nobody has defined is one of the reasons leadership hires fail in the first 12 months.
The bottom line on manufacturing ransomware attacks
Manufacturing ransomware attacks are rising, and mid-market plants are absorbing most of them. Technology helps, but the deciding factor is often leadership: the engineering and operations leaders who understand the production network, and the one person who owns the risk. Manufacturers who put those leaders in place tend to recover faster and face customer audits with less scrambling.
This is the work we do at Index Search, an executive and professional search firm specializing in manufacturing, distribution, and industrial technology. We define each role around the operation it will lead, then reach the engineering and operations leaders who are doing this work at another plant and aren't looking. Clients typically see first candidates in 7 to 10 business days, which matters when a leadership gap is already on an audit list.
Every plant has its own weak spots. Tell us the engineering or operations leadership role you need. We'll share a few candidates from our network who've run connected production environments and could fit your operation. Send us the role you're hiring for.
Written by Lauren Wicker, VP of Marketing at Index Search, who writes about the hiring challenges facing manufacturing, distribution, and industrial technology companies.