The manufacturing industry is performing better in protecting itself against ransomware, according to a recent study from security provider Sophos.

Compared to previous years’ results, many manufacturing companies are now able to stop ransomware attacks before data is encrypted. This year just 40% of cyberattacks against manufacturing entities resulted in data encryption. This is the lowest figure in five years and a decrease from 74% in 2024, Sophos reports.

However, data theft remains a key risk in the sector, with 39% of manufacturers whose data was encrypted by ransomware also suffering data loss — one of the highest rates of all industries surveyed.

One consequence, according to the study, is that more than half of the affected companies paid the ransom despite improved defense measures. The median ransom amount was around €861,000, compared to a median demand of approximately €1 million.

Skilled labor shortages and inadequate protection facilitate attacks

More than four in 10 manufacturing companies (43%) cited a lack of expertise as the reason for the cyber incident. Unknown security vulnerabilities were mentioned by 42%, and a lack of protective measures by 41%.

Furthermore, the results show that ransomware attacks continue to place a heavy burden on IT and security teams. Almost half of manufacturing companies (47%) reported increased stress within their teams following data encryption. Meanwhile, 44% are experiencing increased pressure from management, and 27% confirmed a change in leadership as a result of the attack — a proportion in line with overall trends for security leaders losing their jobs after a ransomware attack.

The study surveyed 332 manufacturing companies worldwide that were affected by ransomware in the past year.

See also:

8 biggest cybersecurity threats manufacturers face

Manufacturers still poorly prepared for cyberattacks as IT/OT converge