The manufacturing sector is experiencing a significant shift in the cyberattack landscape, according to the latest Sophos State of Ransomware in Manufacturing and Production 2025 report.
While the rate of successful data encryption has fallen to a five-year low of 40%—a steep decline from 74% last year—attackers are now heavily leaning on data theft and pure extortion to maintain leverage and pressure on targets.
This pivot in tactics reflects manufacturers’ improved ability to stop attacks early, with 50% of organizations successfully halting the attack before encryption could occur, more than double last year’s figure. However, even with better defense, more than half of the affected manufacturers still chose to pay the ransom.
The report, based on an independent survey of 332 manufacturing organizations hit by ransomware, highlights a critical trade-off:
- Falling Encryption: Only 40% of attacks on manufacturers resulted in data encryption.
- Surging Extortion: Extortion-only attacks (where data is stolen but not encrypted, and payment is demanded to prevent public release) surged to 10% of incidents, up from just 3% in 2024.
- Double Extortion Common: Among those whose data was encrypted, 39% also had their data stolen, indicating a continued reliance on double extortion tactics.
“Attackers exploit this pressure: despite encryption rates falling to 40%, the median ransom paid still reached $1 million,” said Alexandra Rose, Director of Threat Research, Sophos Counter Threat Unit. “While half of manufacturers stopped attacks before encryption, recovery costs average $1.3 million and leadership stress remains high.”
Despite the defensive progress, the financial and operational impact remains severe:
- Ransom Payments: 51% of manufacturing organizations that experienced encryption paid the ransom. The median payment was $1 million.
- Recovery Costs: The average cost to recover (excluding the ransom payment) was $1.3 million. Encouragingly, 58% of manufacturers fully recovered within one week, an improvement from 44% last year.
- Top Threat Groups: Sophos X-Ops has observed 99 distinct threat groups targeting the sector. The most prominent groups reported by Sophos are Akira (GOLD SAHARA), Qilin (GOLD FEATHER), and PLAY (GOLD ENCORE).
The study found that internal factors fueling attacks include a lack of expertise (cited by 42.5%), unknown security gaps (41.6%), and insufficient protection (41%).
Sophos recommends that manufacturing organizations focus on strengthening their long-term defenses:
- Eliminate Root Causes: Proactively address common weaknesses, such as exploited vulnerabilities.
- Defend Every Endpoint: Ensure all systems, especially critical servers, have dedicated anti-ransomware protection.
- Plan and Prepare: Establish and routinely test a comprehensive incident response plan, including regular data restoration practice.
- Monitor Around the Clock: Implement 24/7 threat monitoring, utilizing a Managed Detection and Response (MDR) provider if in-house resources are limited.