When Production Stops: Lessons from 2026’s Manufacturing Cyberattacks
Recovery, not the attack itself, decides how much a shutdown costs.
Manufacturing cyberattacks made headlines again this year, and the pattern is hard to ignore. In July 2026, Coca-Cola reported in an SEC filing that a ransomware attack had stopped production at Fairlife, its dairy brand, with U.S. operations temporarily suspended [1]. The year before, a cyberattack halted Jaguar Land Rover’s production on September 1 for five weeks and caused widespread delays across its supply chain [2]. The UK’s Cyber Monitoring Centre put the financial impact at between £1.6 billion and £2.1 billion, with £1.9 billion the most likely figure [3].
These are not isolated events. According to Black Kite research reported by SecurityWeek, ransomware attacks on manufacturers rose 40% in early 2026 [4]. Dragos identified 1,140 ransomware incidents affecting industrial organizations in Q2 2026, a 12% increase over Q1, with manufacturing the most affected sector at 747 incidents (65%) [5].
Behind the numbers, a few lessons keep showing up.
Lesson 1: Attackers don’t need to reach the plant floor to stop it
Many of this year’s shutdowns started on the business side. In fact, Dragos did not see a single case in Q2 2026 where ransomware operators directly manipulated a control system. Where operations were disrupted, it came after enterprise IT systems were encrypted or shut down as a precaution [5]. The line between IT and OT matters less than most plans assume.
Lesson 2: Recovery takes longer than the attack
Production can stop in hours. Getting it running again takes much longer. Jaguar Land Rover’s lines stayed down for about five weeks [2], and the effects reached thousands of suppliers. The longer it takes to get back to a known good state, the more a single incident costs.
Lesson 3: A backup only helps if it matches what’s running
When it’s time to recover, the first question is simple: do we have a clean, current copy of every program and configuration? For many plants, the honest answer is “probably.” In AMDT’s survey of Octoplant users, about 40% restore a program from backup at least once a month [6]. Yet AMDT-commissioned research by Statista found that only 36% of US industrial organizations back up their devices weekly [7].
We saw this firsthand with a baggage handling system that could not be down for more than 10 minutes. People with remote access were making changes to its code overnight. If a controller failed the next morning, the backup had to match what was actually running. Otherwise, a 10-minute recovery could turn into hours.
Lesson 4: Visibility decides how big the response has to be
When teams can’t see what’s running and what changed, they can’t contain a problem narrowly. Precautionary shutdowns, like the ones Dragos describes [5], often happen because no one can confirm which systems are safe. The clearer your picture of every device and every change, the smaller and faster your response can be.
What resilient plants are doing differently
The manufacturers recovering fastest are not necessarily adding more tools. They make backup and recovery part of everyday operations, with automatic backups across every device and vendor, a clear record of what changed and when, and a tested plan for getting back to a known good state.
This whitepaper takes a closer look at where downtime risk tends to hide and what manufacturers are doing to recover faster when something goes wrong.
Sources
[1] Help Net Security, “Ransomware attack halts Coca-Cola’s Fairlife US milk production,” July 17, 2026, https://www.helpnetsecurity.com/2026/07/17/coca-cola-fairlife-ransomware-attack/
[2] The Guardian, “Jaguar Land Rover hack is costliest cyber attack in UK history, say analysts,” October 2025, as republished by the Maryland Coordination and Analysis Center, https://mcac.maryland.gov/2025/10/jaguar-land-rover-hack-is-costliest-cyber-attack-in-uk-history-say-analysts/
[3] ITPro, “Former NCSC head says the Jaguar Land Rover attack was the ‘single most financially damaging cyber event ever to hit the UK’,” https://www.itpro.com/security/cyber-attacks/jaguar-land-rover-cyber-attack-financial-impact-cyber-monitoring-centre
[4] SecurityWeek, “Ransomware Attacks on Manufacturers Surge as Supply Chain Risk Grows,” September 17, 2026, https://www.securityweek.com/ransomware-attacks-on-manufacturers-surge-as-supply-chain-risk-grows/
[5] Dragos, “Industrial Ransomware Analysis for Q2 2026,” https://www.dragos.com/blog/dragos-industrial-ransomware-analysis-q2-2026
[6] AUVESY-MDT (AMDT), press release on fiscal year 2023, https://auvesy-mdt.com/fileadmin/Basis/Media/PDF/press-financial-year-2023.pdf
[7] Octoplant and Statista, The US OT Security Landscape Report, https://insource.solutions/ot-security-data-manufacturers/
Download the Whitepaper
Complete the form below to download the whitepaper and learn how manufacturers are getting back to production faster.