Cybersecurity for the Manufacturing sector | Hunt & Hackett

As a cornerstone of the global economy, the manufacturing sector has long been a target for financially motivated criminals and nation-state actors alike. Industrial espionage itself dates back centuries - some credit the start of the Industrial Revolution to British silk spinner John Lombe, who in the early 18th century stole proprietary equipment designs from an Italian manufacturer. He returned to England and used the stolen knowledge to build the world’s first successful powered continuous production unit, laying the foundations for the modern factory.

Fast forward 300 years, and the threat of having your ideas stolen - or falling victim to other malicious activity - has not only grown but shifted into cyberspace. Today, manufacturers face an unprecedented surge in cyberattacks, from ransomware and Business Email Compromise to data theft and digital espionage. Nation state (sponsored) threat actors from China, Russia, Iran and North Korea are well known to target manufacturing organizations to obtain a commercial and/or intellectual advantage. As the industry continues to modernize and expand, so do the risks - especially if the appropriate defenses are not in place.

How can you address this growing threat?

There is a legendary saying on how to overcome your adversaries: 'know thy enemy and know yourself; in a hundred battles, you will never be defeated'. To know your enemy starts with gaining an understanding of your threat landscape, your adversaries’ intentions, their modus operandi, and specific attacking methods. The following sections provide a glimpse of the key threats facing the manufacturing sector, followed by our approach for defending against them. The blog series which can be found at the bottom of this page provides further details of the manufacturing threat landscape.

	Manufacturing	Manufacturing + related	Broader focus	All known
APTs	57	347	379	801
TTPs	1,178	3,254	3,330	4,112
Attack tools	900	2,791	2,852	3,666

Our proprietary threat diagnostic system shows an increase in malicious activity targeting the manufacturing sector in recent years. In fact, manufacturing faced more ransomware attacks than any other industry in 2024, accounting for 14% of total incidents. Cybercriminals view manufacturing companies as attractive targets for a few key reasons. For one, manufacturers rely on uninterrupted operations - any disruption can lead to millions in lost revenue, making them prime targets for ransomware extortion. Their vast and complex supply chains introduce additional vulnerabilities, where a breach in one company can ripple across an entire industry.

Intellectual property is another major draw, with cybercriminals and nation-state actors seeking to steal proprietary designs and processes for commercial or strategic gain. On top of that, many manufacturers still depend on aging operational technology (OT) systems that were never designed with cybersecurity in mind. As these systems become more connected through digital transformation, they create new entry points for attackers. To stay ahead of these evolving threats, manufacturers must first understand who is targeting them, what they’re after, and the tactics they use.

January 1, 2022
16:00 PM

Duvel

2024

In March 2024, Belgian beer manufacturer Duvel fell victim to a ransomware attack that temporarily halted production across its breweries. The Russian hacking group Stormous is believed to have carried out the attack, encrypting the company’s systems and stealing up to 88 gigabytes of data. Duvel was given 17 days to pay a ransom or the information would be published online. As a precaution, the company shut down operations at all of its Belgian sites and a brewery in Kansas City. Luckily, it had robust backups in place, allowing operations to resume quickly.[7] Ultimately, Duvel chose not to pay the ransom and the stolen data was leaked online - not by Stormous, but by another criminal group, Black Basta, suggesting the data had been sold. The leaked files included employee passport copies and internal company documents.[8]

This incident shows that while backups help restore operations quickly, they don’t always remove a hacker’s leverage. Ransomware actors are increasingly using double extortion tactics, where stolen data is used as blackmail, pressuring companies to pay even when they don’t need decryption. To learn more about the rise of double and triple extortion attacks, read our Definitive Guide to Ransomware.

January 1, 2022
16:00 PM

Advanced Micro Devices

2024

In June 2024, US semiconductor manufacturer Advanced Micro Devices (AMD) suffered a data breach. Sensitive information - including future product details, technical specifications, customer databases, and internal communications - was reportedly stolen by a threat actor known as IntelBroker. AMD quickly confirmed the breach and launched an investigation.[5] However, just a few months later, the company was targeted by IntelBroker again - this time working alongside another criminal group, EnergyWeaponUser. More data was stolen and listed for sale on dark web marketplaces.[6]

As a leading player in the semiconductor industry, AMD - and companies like it – face a high risk of information theft and corporate espionage due to the immense value of their intellectual property. Cutting-edge chip designs are not only crucial for commercial competitiveness but also have national security implications, making them prime targets for both cybercriminals and state-sponsored actors. As this case demonstrates, once a company is on the radar of threat actors, it can quickly become the target of repeated attacks, with stolen data fueling further breaches and increasing long-term risk.

January 1, 2022
16:00 PM

Toyota

2022 - 2023

In February 2022, Toyota’s production lines came to an abrupt standstill—not due to mechanical failure, but because of a cyberattack on its supply chain. The target wasn’t Toyota itself but Kojima Industries, a supplier of plastic parts and electronic components. With Kojima compromised, Toyota had no choice but to shut down all 14 of its domestic factories for one day, undercutting production by about 13,000 vehicles. Fortunately, a backup network between the two companies allowed operations to resume quickly, preventing a larger crisis.[3] Nonetheless, the incident clearly demonstrated how a cyberattack on a single supplier can ripple outwards, causing major disruption to global production lines.

Just 18 months later, Toyota was impacted by another attack - this time targeting its financial services division. Hackers exploited the widely used Citrix Bleed vulnerability to steal sensitive corporate documents, then threatened to leak the data online unless an $8 million ransom was paid. A ransomware group known as Medusa claimed responsibility for the hack.[4]

Looking at these two incidents together, it’s clear that hackers will leverage every angle they can to extort businesses in the manufacturing sector. If they can’t halt production, they search for other pain points, often using sensitive corporate data as leverage. To stay ahead, businesses need to ensure their defenses cover the full spectrum of cyber threats.

As the manufacturing sector embraces digital transformation, sustainability initiatives, and increased automation, the industry is evolving at an unprecedented pace. While these advancements bring efficiency, scalability, and environmental benefits, they also introduce new cybersecurity challenges. From the growing attack surface created by IoT and cloud adoption to the security risks of IT-OT integration, manufacturers must navigate an increasingly complex threat landscape. The following trends highlight key developments shaping the industry - and the cybersecurity challenges that come along with them.

Digital transformation in manufacturing expands the attack surface

Focus on sustainability is driving the cloud transition

Increasing integration of Operational Technology (OT) and Information Technology (IT) systems exposes companies to new risks

Many companies in the manufacturing sector fall under the scope of the NIS2 Directive as Essential or Important entities. Organizations are expected to address several important aspects of cybersecurity, as outlined in Article 21(2) of the Directive, including:

Awareness of your threat landscape and a data-driven security roadmap
Risk analysis and security policies to safeguard information systems
Incident handling and business continuity to ensure resilience and recovery
Forensic readiness and the ability to perform a root cause analysis
Supply chain and system security for robust protection and secure development

Hunt & Hackett’s Managed Detection and Response (MDR) solution directly aligns with several of the Directive’s key requirements, including the 24-, 72-, and one month incident reporting timelines, forensic readiness requirements, and risk management preparation. Read on to discover the core features of our service.

Additionally, we've developed a practical assessment framework that aligns NIS2 requirements with established cybersecurity standards, including ISO/IEC 27001:2022, ISO/IEC 27002:2022, and CIS controls. Although exact NIS2 requirements are evolving, our standards-based approach provides a robust foundation to benchmark your current cybersecurity measures and pinpoint areas for improvement.

To defend against this threat landscape, it is equally important to gain critical insights into the current resilience level of your organization. To understand thyself it is useful to let (third-party) security specialists assess your defenses and simulate meaningful attacks. When done right, such an approach provides critical insights into the resilience level of the organization against its threat landscape. Hunt & Hackett use its proprietary threat modelling-based approach with its clients in the manufacturing sector to provide meaningful insights as well as tailored solutions for the strategical, tactical, and operational aspects of their cybersecurity program.

In their fight against cyber attacks, our customers typically go through several stages of maturity. By ramping up their prevention, detection and incident readiness over time – and optimizing this for their actual threat landscape – they reach a point where they have developed solid resilience against targeted attacks, with only highly controlled and accepted risks remaining.

There is no simple 'fix' to become resilient against the sophisticated cyber threats of today. Without serious resources or processes for systematic security activities, protection against modern cyber threats like ransomware is just a wish. Hunt & Hackett has developed a unique threat- and sector-driven approach to cybersecurity, enabling you to work from your current situation to a highly improved and controlled situation, optimized for your specific threat landscape and context as an organisation.

Schietschijven1

STAGE 1: Unknown risk
Pre-monitoring
-

Preventitive controls

Limited resilience

Schietschijven2-1

STAGE 2: Reduced risk
Post-monitoring
-

Preventitive CIS controls (IG1)

Detection & response controls

Resilience against non-targeted attacks

Schietschijven3

STAGE 3: Controlled risk
Implemented roadmap
-

Alignment between preventitive, detection & response CIS controls (IG2)

Resilience against non-targeted and semi-targeted attacks

Schietschijven4

STAGE 4: Highly controlled risk
Targeted attack resilience
-

Full redundancy between preventitve, detection & response CIS controls (IG3)

Resilience against against advanced targeted attacks