OT Ransomware in Manufacturing and How to Keep the Line Running

Black Kite’s 2026 manufacturing ransomware report counted 1,183 publicly disclosed incidents in the sector from January 1 to July 29, 2026. That already tops Black Kite’s full-year totals for 2023 and for 2024. Same-period counts ran 505 in 2023, 593 in 2024 and 847 in 2025, so 2026 shows a 39.7% increase over 2025. The tally includes only publicly disclosed victims found through leak sites, extortion posts and dark web sources. So the cyber risk firm calls it “a conservative baseline rather than a complete count.” OT ransomware, meaning an attack that reaches the operational technology (OT) on the plant network, is a narrower slice that a victim count does not show.

For a plant or operations manager, the number of incidents is only part of the concern. The bigger question is what happens to production when an attack reaches the facility. Can the line keep running if the business network is down? Can the team determine whether the plant network has been compromised? Those are the questions that matter when an incident moves from an IT problem to an operational one.

How Ransomware Reaches the Production Line

The National Institute of Standards and Technology (NIST) defines operational technology as programmable systems and devices that interact with the physical environment, or manage devices that do. Intrusions affecting information technology (IT) networks can also affect critical operational processes, even if they never directly touch the OT network, according to the Cybersecurity and Infrastructure Security Agency (CISA). The agency adds that OT components are often connected to IT networks, which gives attackers a path to pivot from IT into OT. Within OT, NIST warns, an interrupted flow of information can cause loss of view and loss of control of operations.

The National Security Agency (NSA) and CISA have seen attackers use spearphishing to get into an organization’s IT network and then pivot to the OT network. They have also seen attackers connect to internet-accessible programmable logic controllers (PLCs) that required no authentication. NIST’s 2023 guide notes that an OT system can stay in service for more than 20 years, so many legacy systems run hardware and software that vendors no longer support and that cannot be patched.

In a May 2025 fact sheet, CISA, the Federal Bureau of Investigation (FBI), the Environmental Protection Agency (EPA) and the Department of Energy (DOE) published primary mitigations for OT. Four of those recommendations can be applied directly to your plant, including systems such as historians, engineering workstations that connect to both IT and OT networks, and remote access used by vendors. Ask yourself:

• Is any OT system connected to the public internet?
• Where remote access is essential, does it use a private connection and a virtual private network (VPN) with a strong password and phishing-resistant multifactor authentication (MFA)?
• Are the IT and OT networks segmented, including a demilitarized zone (DMZ)?
• Could your team operate the OT systems manually today, and does it practice doing so?

If the answer to any of these questions is “no,” you may have a gap in your OT security that federal agencies have already identified as a priority.

What Happened to Operations at Colonial Pipeline, JBS and Norsk Hydro

Three well-known ransomware incidents show the issue from an operational perspective. Colonial Pipeline is a pipeline operator, while JBS USA and Norsk Hydro are manufacturers, but all three cases show how a cyberattack can affect physical operations, even when the initial impact is on IT systems. The table below puts them side by side.

NIST’s account of the Colonial Pipeline incident found no evidence that the attack directly affected the company’s OT environment. Even so, Colonial shut down physical operations as a precaution while the incident was contained. At Norsk Hydro, areas that maintained near-normal production relied on manual procedures and labor-intensive workarounds.

The lesson for a plant is not simply whether an attack reaches OT. It is whether your team has enough visibility and operational flexibility to make decisions when IT systems are unavailable. What would you need to know before continuing production with the business network down? Which processes could your team operate manually, and for how long?

Why Protecting the Plant Boundary Comes Before Detecting Ransomware

If your company already pays for monitoring, you may reasonably assume it would catch ransomware in time to protect the line. Monitoring does real work, but an alert reports activity that has already happened on the network. The decision in the room is about whether OT ransomware could still reach production. Dynics holds that in OT, organizations must shift toward prevention and control before impact and away from retrospective detection after the fact.

In practice, that starts with deny by default. Only allow connections when they are explicitly required, give each connection a defined path, and enforce what is allowed to cross the boundary.

A flat OT network, where every device can reach every other, gives ransomware the widest possible attack radius. As Dynics explains in its guide to OT network segmentation, segmentation does not necessarily prevent the initial compromise. An attacker may still gain access through remote access, a vendor connection, a laptop or the business network. What segmentation can do is limit how far that compromise can travel by separating critical systems and controlling communication between zones. Could you name and justify every connection that crosses your plant boundary today?

If you have watched a security project built for IT interrupt production, the doubt is fair. ICS360.Defender delivers OT cybersecurity at the network edge, and its units sit at the network perimeter and in production zones. Each unit first learns the plant’s communication flows, then allows those flows and blocks all other traffic, so the rules start from how your plant already communicates. Seeing the traffic comes before blocking it, because you cannot control what you cannot see.

Automated traffic learning supports the rollout, and each unit combines nearly real-time visibility, deep packet inspection (DPI) firewalling and secure remote access. Dynics applies that inspection across Modbus, PROFINET, EtherNet/IP and other industrial protocols.

At the switch level, the OT SDN Controller works with ICS360.FlexConnect managed switches and uses software-defined networking (SDN) to enforce segmentation and communication policy without relying on complex virtual local area networks (VLANs). It follows the same deny-by-default approach. No traffic passes through the switches unless it is explicitly defined as acceptable, and unknown traffic is blocked and flagged. It can lock down even the oldest PLCs without expensive upgrades or changes to the device, which matters given the long service lives NIST describes for OT systems. The controller is one part of Dynics OT cybersecurity, built to protect, visualize and control plant networks.

Controlling How Vendors and Integrators Reach Plant Systems

When an integrator or machine builder supports one of your cells remotely, the work runs through remote access software. A June 2023 joint guide from CISA, the NSA, the FBI and partner agencies warns that threat actors are increasingly co-opting these tools for broad access to victim systems. CISA’s ransomware guidance adds that ransomware actors often get in through exposed and poorly secured remote services such as Remote Desktop Protocol (RDP). The connection that lets a vendor help you is therefore also a possible way in for an attacker.

For vendor sessions and any other remote access that is essential, the May 2025 OT mitigations call for a private connection and a VPN with a strong password and phishing-resistant MFA. Dynics names secure remote access that controls third-party and vendor connections as one part of effective OT defense. ICS360.IAM controls who can access what, and when, and it works with the ICS360.DCC console so access is managed from one place. The ICS360.DCC console also monitors remote connections to each ICS360.Defender.

Planning for Manual Operation and a Safe Restart

CISA recommends developing and regularly testing workarounds or manual controls so critical processes, and the industrial control system networks behind them, can be isolated and kept in operation without access to IT networks. The May 2025 fact sheet adds that reverting to manual controls is vital right after an incident. In NIST’s account of Norsk Hydro, the company transitioned to manual operations and was transparent with the public about its recovery.

A safe restart needs something clean to restart from. NSA and CISA advise keeping off-network “gold copies” of firmware, software, ladder logic and configuration information. The same advice covers service contracts, product licenses and product keys. Testing recovery procedures for OT components can be difficult because of operational and safety requirements, NIST notes, so when a full recovery test cannot be performed, organizations should at least verify the integrity of their backups.

At the boundary itself, the ICS360.DCC console can create, retrieve and restore backups of individual ICS360.Defender configurations. The logic running your PLCs sits outside those backups, which is why the gold copies still matter. CISA strongly discourages paying a ransom, warning that a payment offers no assurance that data will be decrypted or that systems are no longer compromised.

Frequently Asked Questions About OT Ransomware

How does ransomware affect manufacturing plants?

It can cut into production even when it only reaches the business network. In a 2020 advisory, NSA and CISA list partial loss of view for human operators, resulting in loss of productivity and revenue, among the impacts of attacks on OT. In its True Cost of Downtime 2024 report, Siemens found that automotive manufacturers lose $2.3 million for each unproductive hour, a figure that covers every cause of unplanned downtime.

How does ransomware spread to OT networks?

OT ransomware does not necessarily start at a plant-floor device. Attackers can get in through remote access, compromised credentials, vendor connections, laptops or the corporate IT network, and a flat plant network lets the ransomware spread once it is inside. CISA warns that segmentation can be made ineffective when policies are not followed, for example when removable storage media or other devices are connected to more than one segment. Dynics names micro-segmentation, which isolates traffic and limits lateral movement, as one part of effective OT defense.

What is the best defense against OT ransomware?

No single product settles it, so the practical answer to OT ransomware is a layered defense that puts control of what reaches the plant ahead of detection. NIST notes that the relatively static nature of OT environments makes application allowlisting a fit for defense in depth. Dynics builds its approach on deny by default, so only explicitly required connections are allowed in.

Which industry has the most ransomware attacks?

Manufacturing ranked as the most affected sector in Black Kite’s 2026 Ransomware Report. Between April 2025 and March 2026, Black Kite tracked 1,660 manufacturing victims, 22.0% of the 7,551 publicly disclosed ransomware victims it recorded. Victims that were never publicly disclosed are not in that count.

Deciding Whether the Line Keeps Running

When ransomware hits, the question for the plant is easy to ask and hard to answer on the day. Does the line keep running? Most of that answer is settled before the attack, by how the plant boundary is controlled, how vendors get in, and whether your team can run the process by hand. Define your network boundaries before an incident defines them for you.