News & blogs

Alarming: 65% of manufacturers have experienced a ransomware attack

05 May

Ransom-what? Ransom-how? Ransom-where?

Last year, 65% of all manufacturing organisations were affected by ransomware. In two out of three cases, the attack involved data being held hostage. Ransomware is a type of malicious software (malware) that infiltrates and disrupts a computer or network. These networks are typically connected to other systems, which means ransomware can spread rapidly. During an attack, cybercriminals encrypt or lock critical company data and demand large sums of money in exchange for releasing it.

How do ransomware attacks happen?

Cybercriminals exploit vulnerabilities in your organisation’s security to inject ransomware into vital systems. It often starts with an unsuspecting colleague opening a phishing email or clicking on a malicious link. Or perhaps someone unknowingly downloads a file infected with malware. In these situations, attackers are exploiting the human factor. Technical weaknesses are also frequently targeted, such as outdated systems that haven’t been patched with the latest security updates.

What’s the cost of a ransomware attack?

The primary goal of a ransomware attack is financial gain. Last year, the average cost per incident was €2.88 million (Sophos Ransomware Report). Shockingly, that figure doesn’t even include the ransom itself. It reflects the costs of recovery: restoring systems, managing customer, staff and supplier fallout, lost productivity, legal fees, and reputational damage. The true impact of ransomware goes far beyond the balance sheet.

A chain is only as strong as its weakest link

Once ransomware infiltrates a system, it can spread quickly across connected devices and networks. In manufacturing, an average of 44% of all systems are infected during an attack. Worse still, it doesn’t stop at your organisation’s walls. Your customers, suppliers and other partners may also be affected.

Take these real-world examples:

VDL hit by ransomware

In 2021, Dutch manufacturer VDL Group fell victim to a major cyberattack. Using malware, attackers encrypted and blocked access to company data. The effects were felt not just within VDL, but by major clients like ASML, resulting in millions of euros in damage.

Casio stops ticking

Following a ransomware attack on 5 October 2024, watchmaker Casio faced severe order delays. It took weeks before shipments could resume. Meanwhile, the personal data of 6,400 employees and 1,900 business partners was leaked, and attackers gained access to invoices, contracts and internal meeting records.

Bassett Furniture grinds to a halt

In 2024, one of the largest US furniture manufacturers, Bassett Furniture Industries, was forced to suspend all production for at least a week following a ransomware attack that brought their entire operation to a standstill.

You’ve been hit. Now what?

Besides the obvious first steps (disconnecting the infected system from the network and disabling Wi-Fi or VPN access) many organisations are left with a tough question: should we pay the ransom or not? The numbers speak volumes: 6 in 10 manufacturing organisations paid the ransom in 2024. That’s double the rate from the year before.

However, it is strongly advised to not pay the ransom fee. Why? Because there’s no guarantee your data will be returned, and you’re effectively funding criminal activity. Plus, you often end up paying twice: once for the ransom, and again to repair the damage.

You have high-vis vests and emergency stop buttons, but what about your organisation’s cyber safety?

To protect against ransomware and other forms of cybercrime, you need a robust, up-to-date IT infrastructure. Outdated systems are easy targets, offering attackers a direct line to sensitive information and critical files. But infrastructure alone isn’t enough. You also need to focus on access controls and network segmentation, limiting who can access what (whether they’re employees, clients, or suppliers).

Even with the strongest technical defences in place, your organisation remains at risk if your “human firewall” isn’t working. Social engineering attacks prey on human emotions such as curiosity, urgency or fear. They use these emotions to fool staff into unknowingly letting in malware. That’s why security awareness training isn’t a luxury, it’s a necessity. When your employees know how to spot and stop these threats, they become your first line of defence. Only by combining technical resilience with human awareness can you keep cybercriminals out.