Manufacturers are stopping more ransomware attacks before data can be encrypted. However, adversaries are increasingly stealing data and using extortion-only tactics to maintain pressure.
As a result, more than half of manufacturing organizations impacted by encryption paid the ransom despite progress in defensive measures.
These are from a report based on an independent survey commissioned by Sophos and conducted by a third-party specialist between January and March 2025. It covered 332 manufacturing organizations across 17 markets and which were hit by ransomware in the last year.
Findings show that encryption rates are falling, but adversaries are shifting tactics. Two-fifths (40%) of attacks on manufacturers resulted in data encryption, the lowest level in five years and down from 74% last year. However, extortion only attacks surged to 10% from just 3% in 2024 as attackers increase reliance on data theft for leverage.
Data theft remains a significant concern, with 39% of manufacturers that experienced encryption also having had data stolen, one of the highest rates across all surveyed sectors.
More organizations are stopping attacks before encryption. Half of manufacturing organizations stopped the attack before data could be encrypted, more than double last year’s 24%.
Expertise shortfalls and inadequate protection fuel attacks. Lack of expertise was cited by 42.5% of organizations.
Unknown security gaps were cited by 41.6%, and a lack of protection by 41%. Respondents identified an average of three internal factors that contributed to the attack.
More than half of manufacturers with encrypted data paid the ransom as 51% of affected organizations paid the ransom. The median ransom paid was $1 million dollars, compared to a median demand of $1.2 million dollars.
Recovery costs and timelines are improving. The average cost to recover from a ransomware attack, excluding ransom payment, declined by 24% to $1.3 million dollars. About three-fifths (58%) of manufacturers fully recovered within one week, up from 44% last year.
Ransomware incidents affect IT and security teams. Close to half (47%) of manufacturers reported increased team stress after experiencing data encryption. 44% said pressure from senior leaders increased, and 27% reported leadership change as a result of the attack.
“Manufacturing depends on interconnected systems where even brief downtime can stop production and ripple across supply chains,” said Alexandra Rose, director of threat research, Sophos Counter Threat Unit.
“While half of manufacturers stopped attacks before encryption, recovery costs average $1.3 million and leadership stress remains high,” she said. “Layered defenses, continuous visibility, and well-rehearsed response plans are essential to reduce both operational impact and financial risk.”
Over the past 12 months, Sophos X-Ops has observed ransomware activity across leak sites and found that 99 distinct threat groups targeted manufacturing organizations.
The most prominent groups targeting manufacturing organizations based on leak site observations are GOLD SAHARA (Akira), GOLD FEATHER (Qilin) and GOLD ENCORE (PLAY).
