Last Updated: March 6, 2026

85+ Manufacturing Cybersecurity Statistics for 2025-2026

Manufacturing is now the most cyberattacked industry in the world. For the fifth consecutive year, manufacturers absorbed more cyberattacks than any other sector in 2025, accounting for 27.7% of all incidents tracked by IBM X-Force. Ransomware groups posted 1,060 manufacturing victims last year alone. The combination of legacy operational technology, valuable intellectual property, and near-zero tolerance for downtime makes every plant, every production line, and every connected machine a target.

We compiled over 85 data points from IBM X-Force, Dragos, GuidePoint Security, Bitsight, the Ponemon Institute, Gartner, and other authoritative sources. Every statistic links to its original source so you can verify the data, cite it in board presentations, or use it to justify your cybersecurity budget.

Headline Cybersecurity Numbers for Manufacturing

These are the numbers every manufacturing executive, IT director, and plant manager should know heading into 2026. The manufacturing sector's position as the number one target for cyberattacks isn't new, but the scale and severity of attacks keeps climbing.

• Manufacturing represented 27.7% of all cyberattacks in 2025, the highest share of any industry for the fifth consecutive year. (IBM X-Force Threat Intelligence Index 2026)
• Ransomware attacks on manufacturing increased 58% year-over-year in 2025, with 1,060 manufacturing victims posted on leak sites. (GuidePoint Security GRIT Report 2026)
• Manufacturing accounted for 22% of the 4,853 cyberattacks tracked by Bitsight TRACE where sector attribution was possible, making it the most targeted industry for the third consecutive year. (Bitsight, 2025)
• Manufacturing made up 68% of all industrial ransomware incidents in Q1 2025. (Dragos Q1 2025 Ransomware Report)
• The industrial sector experienced the highest increase in data breach costs, rising by $830,000 on average year-over-year. (IBM Cost of a Data Breach 2025)
• Global cybersecurity spending is projected to reach $240 billion in 2026, a 12.5% increase over 2025. (Gartner, 2025)
• 124 distinct ransomware groups were active in 2025, the highest number ever recorded and a 46% year-over-year increase. (GuidePoint Security, 2026)
• 9,251 ransomware cases were exposed on the dark web in 2025, a 45% increase since 2024. (NordStellar, 2026)

Attack Frequency and Targeting Trends

Manufacturing hasn't just been the most targeted industry for one or two years. It's been the top target for five straight years running. The combination of operational pressure, intellectual property, and growing attack surface from Industry 4.0 adoption keeps making manufacturers more attractive to threat actors.

• 2025 marked the fifth consecutive year that manufacturing topped IBM X-Force's most-attacked industries list. (IBM X-Force, 2026)
• Manufacturing saw a 71% surge in threat actor activity between 2024 and Q1 2025, with 29 distinct groups targeting the sector. (Bitsight, 2025)
• About 50% of all ransomware attacks in 2025 targeted critical infrastructure, with manufacturing, healthcare, energy, and transportation bearing the brunt. (Industrial Cyber, 2025)
• Manufacturing saw a 61% year-over-year surge in ransomware incidents specifically, outpacing all other sectors. (DeepStrike, 2025)
• Global ransomware attacks against critical industries surged by 34% in 2025. The U.S. was the top target, accounting for 21% of global incidents. (KELA via Industrial Cyber, 2025)
• December 2025 was the most active month for ransomware on record, with 814 claimed victims. Over 2,000 ransomware victims were posted in Q4 alone. (GuidePoint Security, 2026)
• Chinese threat groups are responsible for approximately 4% of all targeting activity against manufacturers, reflecting economic espionage and strategic disruption. (Bitsight, 2025)

Ransomware in Manufacturing

Ransomware remains the single biggest cyber threat to manufacturers. The shift from simple encryption to double extortion (encrypting data and threatening to leak it) and even triple extortion (adding DDoS pressure or contacting customers) has made these attacks far more damaging and harder to recover from.

• 1,060 manufacturing companies were listed as ransomware victims on leak sites in 2025, representing 14% of all ransomware targets across industries. (GuidePoint Security, 2026)
• The most active ransomware groups targeting manufacturing in 2025 were Qilin, Akira, and Play. (GuidePoint Security, 2026)
• The average total cost of a ransomware attack ranges between $1.8 million and $5 million, including downtime, recovery, and reputational damage. (VikingCloud, 2026)
• The average cost of a disclosed ransomware incident climbed to $5.08 million, reflecting investigation costs, downtime, legal exposure, and reputational damage. (SOCRadar, 2026)
• Average ransom payments increased by 500% over the past year, reaching an average of $2 million per demand. (VikingCloud, 2026)
• The average downtime from a ransomware attack is 24 days. For manufacturers running 24/7 production lines, that represents catastrophic losses. (PurpleSec, 2025)
• Over 5,600 ransomware attacks were publicly disclosed worldwide in 2024, with more than 2,600 victims based in the U.S. (Fortinet, 2025)
• Ransomware incidents in 2026 are projected to exceed 12,000, according to NordStellar. (NordStellar, 2026)
• 45% of cyberattacks on manufacturing involved malware focused on disrupting operations or financial extortion. (IBM X-Force, 2026)
• Ransomware accounts for 19% of all cyber insurance claims. (VikingCloud, 2026)

Data Breach and Downtime Costs

The financial damage from a cyberattack on a manufacturer goes far beyond the ransom payment. Lost production, forensic investigations, legal fees, customer notification, and long-term reputational damage all add up. Manufacturing's high downtime costs make it one of the most expensive sectors to recover from a breach.

• The global average cost of a data breach reached $4.88 million in 2025, a 10% increase year-over-year. (IBM Cost of a Data Breach 2025)
• Data breaches involving OT systems cost an average of $4.56 million. (Elisity, 2025)
• Unplanned downtime costs manufacturers roughly $260,000 per hour on average. For Fortune 500 companies, unplanned downtime accounts for roughly 11% of annual revenue, about $1.5 trillion worldwide. (Cyber Magazine / Siemens)
• Businesses pay $53,000 per hour on average in downtime costs caused by ransomware. (VikingCloud, 2026)
• The cost of recovering from a ransomware attack is 10x the ransom demand on average. (VikingCloud, 2026)
• 40% of manufacturing cyberattacks involved data theft targeting financial assets and intellectual property like trade secrets. (IBM X-Force, 2026)
• 20% of cyberattacks on manufacturers resulted in brand reputation damage. (IBM X-Force, 2026)
• 10% of attackers harvested credentials for future access after initial breach. (IBM X-Force, 2026)
• Among businesses hit by cyberattacks, 52% lost more than 5% of total revenue. 15% lost more than 10% of annual revenue from a single incident. (VikingCloud, 2026)
• Firms lose up to 1.3% of their market value in the month following a cyberattack. (VikingCloud, 2026)
• 60% of small businesses that suffer a cyberattack go out of business within six months. (PreVeil, 2026)
• At least six in ten businesses raised prices to help recover costs incurred by cyberattacks. (VikingCloud, 2026)

Attack Vectors and Entry Points

How are attackers getting into manufacturing networks? The answer has shifted significantly. Exploiting public-facing applications and using stolen credentials now dominate, while traditional malware delivery continues to evolve. Understanding these entry points is critical for prioritizing defenses.

• Exploitation of public-facing applications was the top entry method for manufacturing cyberattacks, accounting for 32% of observed cases. (IBM X-Force, 2026)
• Valid account abuse accounted for 16% of manufacturing breaches. Attackers used legitimate credentials rather than breaking in. (IBM X-Force, 2026)
• External remote services were used in 11% of attacks, reflecting misconfigured or insufficiently secured access points. (IBM X-Force, 2026)
• Abusing valid accounts is now the preferred entry point for cybercriminals overall, accounting for 30% of all incidents across industries. (IBM X-Force Threat Intelligence Index 2025)
• Over 90% of cyberattack incidents originate from phishing emails. (Bitsight, 2025)
• Up to 98% of cyberattacks involve social engineering in some form. (VikingCloud, 2026)
• Infostealer malware saw an 800% increase in stolen credentials in the first half of 2025, with 1.8 billion credentials harvested from 5.8 million infected devices. (DeepStrike, 2025)
• IBM observed an 84% weekly increase in phishing emails designed to deliver infostealer malware. (IBM X-Force, 2026)
• 46% of systems compromised by infostealers were non-managed personal devices used for both work and personal activities. (Verizon 2025 DBIR)
• Almost a third of attackers used compromised credentials to access administrative or IT tools like remote management utilities, scripting tools, and built-in OS functions. (IBM X-Force, 2026)

Operational Technology (OT) and ICS Security

The convergence of IT and OT networks is one of the biggest cybersecurity risks facing both large manufacturing organizations and small shops today. In the modern threat landscape, legacy industrial control systems (ICS) were never designed to be connected to the internet, but Industry 4.0 adoption has bridged that gap, often without adequate cybersecurity defenses in place. According to IBM's research, attackers leverage these gaps to compromise the entire supply chain. Building comprehensive cybersecurity programs that protect sensitive data across both IT and OT environments is no longer optional.

• Manufacturing accounted for 68% of all industrial ransomware incidents tracked by Dragos in Q1 2025. (Dragos, 2025)
• OT-impacting data breaches cost an average of $4.56 million, well above the cross-industry average. (Elisity, 2025)
• Complex OT environments are a primary reason manufacturing remains attractive to attackers. Legacy systems running outdated software with known vulnerabilities create easy entry points. (IBM X-Force, 2026)
• The rapid adoption of Industry 4.0 technologies (AI, IoT devices, cloud computing) introduces complex new vulnerabilities across both IT and OT environments. (Bitsight, 2025)
• Supply chain attacks increasingly bypass direct defenses by targeting third-party vendors, software suppliers, and hardware manufacturers that connect to OT networks. (Bitsight, 2025)
• Open-source software vulnerabilities in manufacturing supply chains introduce significant security blind spots as cybercriminals exploit tainted code in package repositories. (Bitsight, 2025)

Cybersecurity Spending and Budgets

Despite being the most targeted industry, manufacturing historically spends less on cybersecurity than sectors like financial services or healthcare. That gap is starting to close as attacks become more costly, but many manufacturers, especially small and mid-size operations, still underinvest.

• Manufacturing companies spend approximately 6.1% of their IT budgets on cybersecurity, according to industry surveys. This is significantly less than healthcare (13.3%) or financial services. (XenTegra, 2025)
• Global cybersecurity spending will reach $240 billion in 2026, a 12.5% increase over 2025. (Elisity / Gartner, 2026)
• Only 74% of companies have specific cybercrime insurance to cover losses. (VikingCloud, 2026)
• Cyber insurance claims are increasing by approximately 13% year-over-year, with an average loss of around $100,000 per claim. (VikingCloud, 2026)
• Written direct premiums for cyber insurance are expected to reach $23 billion by end of 2025. (VikingCloud, 2026)
• Up to 60% of companies on supply chains now use cybersecurity risk as a buying consideration when selecting partners. (VikingCloud, 2026)
• More than 86% of firms are adopting zero trust security models. (VikingCloud, 2026)
• Small businesses can expect to pay between $120,000 and $1.24 million to respond to and resolve a security incident. (IBM Cost of a Data Breach 2025)

Cybersecurity Workforce and Skills Gap

Finding qualified cybersecurity professionals is a challenge across every industry, but manufacturers face a double bind: they need people who understand both IT security and OT environments, and those specialists are in extremely short supply.

• 79% of frontline cybersecurity managers say a successful cyberattack hit their organization in the past year, compared to 65% of C-suite leaders. (VikingCloud, 2025)
• 81% of frontline managers admit at least one material cyber incident went unreported to leadership in the past year. (VikingCloud, 2025)
• 90% of frontline cybersecurity managers say attacks are more frequent compared with the prior year, while 77% of C-suite leaders agree. (VikingCloud, 2025)
• 88% of frontline managers say attacks have been more severe over the past 12 months. (VikingCloud, 2025)
• 53% of companies actively train staff on how to minimize internal risks. (VikingCloud, 2026)
• 36% of C-suite cyber leaders and 38% of managers admit that the technology behind cyberattacks is more sophisticated than their own. (VikingCloud, 2025)

AI-Driven Threats and Emerging Risks

Artificial intelligence is changing the cybersecurity landscape from both sides. Manufacturers are using AI for threat detection and response, but attackers are using it to create more convincing phishing campaigns, deepfake impersonations, and automated attack tools. The arms race is accelerating.

• 97% of companies report GenAI-related security issues and breaches. (VikingCloud, 2026)
• 62% of frontline managers and 53% of C-suite leaders identify AI-driven attacks as their biggest cybersecurity challenge. (VikingCloud, 2025)
• AI-driven phishing campaigns increased by 1,265% as attackers use generative AI to craft hyper-personalized, context-aware phishing emails at scale. (DeepStrike, 2025)
• One in five organizations experienced a data breach stemming from "shadow AI" (unauthorized use of AI tools by employees), adding an average of $670,000 to total breach costs. (IBM Cost of a Data Breach 2025)
• Cybersecurity professionals reporting being least prepared for deepfake attacks rose from 3% to 21% among managers and from 6% to 28% among C-suite leaders in just one year. (VikingCloud, 2025)
• The top C-suite AI threat concerns are generative/agentic AI-driven phishing (45%), GenAI model prompt hacking (44%), and AI-vishing or voice deepfakes (43%). (VikingCloud, 2025)
• Cybercrime costs are projected to reach $15.63 trillion by 2029, driven in large part by AI-enabled attacks. (VikingCloud, 2026)

Notable Manufacturing Cyberattacks (2024-2025)

Real-world attacks on manufacturers demonstrate the scale and severity of the cybersecurity threat. These incidents affected companies ranging from global industrial giants to specialized component suppliers.

• Unimicron (January 2025): The global leader in PCB production was hit by the Sarcoma ransomware group, disrupting its operations in China. PCB supply chains were affected across the electronics industry. (DeepStrike, 2025)
• Nucor Corporation (May 2025): The largest US steelmaker experienced a cyberattack that disrupted operations. As the country's biggest steel producer by volume, the incident highlighted the vulnerability of critical materials manufacturers. (DeepStrike, 2025)
• Small and mid-size US manufacturers were disproportionately targeted throughout 2025, especially in general manufacturing, machinery, and appliances/electrical/electronics manufacturing. (NordStellar, 2026)
• Ransomware groups deliberately exploited end-of-year cybersecurity gaps caused by reduced staffing and monitoring in Q4 2025. (Smart Industry, 2026)

Global and Regional Breakdown

Manufacturing cyberattacks are a global problem, but certain regions bear more of the burden. Asia-Pacific leads in attack volume due to the concentration of manufacturing operations, while the US remains the primary target for ransomware specifically.

• Asia-Pacific saw 68% of manufacturing-related cyber incidents in 2025, reflecting the region's massive manufacturing base. (IBM X-Force, 2026)
• North America accounted for 23% of manufacturing cyberattacks. (IBM X-Force, 2026)
• Europe represented 5% of manufacturing cyber incidents, with Latin America at 2%. (IBM X-Force, 2026)
• More than 55% of ransomware victims were headquartered in the United States. Canada followed at 4.48%, and Germany at 4.1%. (GuidePoint Security, 2026)
• The U.S. was the top geographic target for ransomware, accounting for 21% of global critical infrastructure incidents. (KELA via Industrial Cyber, 2025)

What These Cybersecurity Statistics Mean for Manufacturers

The data tells a clear story. Manufacturing organizations face more cyberattacks, more sophisticated threat actors, and higher recovery costs than virtually any other industry. The current threat landscape shows no signs of slowing down. The question isn't whether your operation will be targeted. It's when, and how prepared you'll be when it happens.

Several trends stand out from the 2025-2026 data. First, attackers are increasingly "logging in, not hacking in," meaning stolen credentials and valid account abuse have replaced brute-force methods. This makes identity management and multi-factor authentication non-negotiable for any manufacturer. Second, the convergence of IT and OT networks has created interconnected attack paths that didn't exist five years ago. A phishing email opened by someone in accounting can now ripple through the network and cascade into a production shutdown. Third, small and mid-size manufacturers are absorbing a disproportionate share of attacks, likely because they lack dedicated security teams and still rely on perimeter-based cyber defense strategies.

The state of cybersecurity in manufacturing reveals a troubling spending gap. Manufacturing allocates just 6.1% of IT budgets to cybersecurity, roughly half of what healthcare spends. Given that manufacturing is the most attacked sector, this underinvestment creates a dangerous mismatch between cyber risk and readiness. Manufacturing cybersecurity concerns are growing at the board level, but budgets haven't caught up. Companies that close this gap with strong cybersecurity practices, network segmentation between IT and OT, zero trust architectures, security awareness training, and incident response planning will build the cyber resilience needed to survive attacks without catastrophic production losses. Improving your cybersecurity posture isn't optional anymore. It's a business survival requirement.

Looking at the trajectory from 2022 through 2023 and into 2025-2026, the X-Force 2025 Threat Intelligence Index confirms that cybersecurity threats targeting manufacturers have grown every single year. The numbers aren't abstract. They represent real production lines going dark, real intellectual property being stolen, and real companies paying millions to recover.

Cite This Report

Sources