Two Ransomware Attack Post-Mortems on Factories: Production Lines Untouched, Yet Fully Shut Down — Rethinking Factory Network Perimeter Security

Two typical ransomware incidents targeting manufacturers this year have overturned long-held assumptions about industrial cybersecurity. They serve as benchmark cases for manufacturing enterprises, system integrators and network operation teams to review. For a long time, factories have focused security investments on OT assets such as PLCs and robots, assuming production will keep running as long as industrial control devices remain uncompromised. These two incidents prove attackers do not need to take over OT equipment. By breaching the IT‑OT perimeter link and crippling upstream business support systems, they can halt entire production lines. This has become the dominant tactic in modern industrial ransomware campaigns.

1. Case Review: No Intrusion into Industrial Controls, Production Still Locked Up

West Pharmaceutical
A phishing email disguised as an industrial equipment update notice slipped into the network, enabling lateral movement for over a month. In early May, systems across 50 facilities in 18 countries were encrypted simultaneously. SEC 8-K filings estimated losses between USD 250 million and 350 million. Disruptions to downstream pharmaceutical supply chains triggered official shortage alerts.

Fairlife (Coca-Cola subsidiary)
Ransomware hit the firm in mid-July, shutting down four US plants for 72 hours. Production and sales losses reached roughly USD 17.5 million, and 671 GB of internal data was confirmed leaked.

In both incidents, attackers left PLC systems untouched. Disabling ERP platforms, file servers and warehouse management systems was enough to stop manufacturing. This defines the 2026 ransomware playbook for industry: skip OT, compromise the IT‑OT boundary. Third-party vendor access accounts for more than 60% of manufacturing data breaches, and AI-generated phishing emails make up over half of attack vectors, creating hard-to-spot entry points.

2. Three Core Practical Steps for Factory Cybersecurity

Instead of chasing the unrealistic goal of “blocking all attacks at the perimeter”, factories should adopt a new mindset: if an attacker gets in, they cannot cause harm; if harm occurs, the incident can be traced. The three key measures are as follows:

1. Real-name access control
   All access to office networks, visitor Wi‑Fi and temporary networks for contractors must bind every user and endpoint to an identity at the moment of connection. Weak passwords, unencrypted access and missing logs for employee terminals are classified as typical non-compliant risks by cybersecurity authorities, as stated by Deyang Cyberspace Security.
2. Behaviour logging
   When an incident occurs, administrators must be able to answer: which endpoint was the entry point, and which servers were reached via lateral movement. Without behaviour logs, incident reconstruction becomes guesswork. Factories need complete internet access logs to meet local public security compliance requirements, which also forms the baseline for security audit.
3. Perimeter consolidation
   Segregate office and production networks where required, and deploy filtering at internet egress points. Firewalls, network admission control and endpoint management each fulfil their dedicated roles.

Many factories deploy IT and OT networks separately with fragmented security hardware: standalone firewalls, audit systems and admission control tools. A proliferation of appliances leads to scattered security policies, difficult unified management, policy conflicts and overlooked permissions. The challenge worsens for multi-site factories with frequent contractor remote access.

Built on all-optical networks, powered by audio & video engines and protected by native security, AINOPOL delivers an integrated connectivity-security solution for industrial scenarios. The Dream Gateway M1 consolidates perimeter firewall, access authentication, behaviour audit and log retention into one hardware unit. A single device secures the internet gateway, combining network transmission, encryption protection and real-name auditing.

While ensuring stable forwarding for office and production traffic, it naturally consolidates network boundaries. It enforces unified real-name authentication for staff, visitors and external contractors, automatically generates traceable logs, and supports logical isolation between IT and OT security zones. It fits multi-segment factory architectures without stacking dozens of discrete security boxes and cuts operational overhead.

Ransomware preys on trust loopholes at network boundaries and weak identity governance. Although production controllers remain critical assets, ERP systems, warehouse platforms, business servers and third-party access channels have become higher-priority weak points in modern factories. Industrial security cannot focus solely on shopfloor controllers. A closed loop covering perimeter defence, identity management and audit logging is the core defence against this new breed of ransomware attacks.

FAQ

Q: My factory already has a firewall. Why was ransomware still successful?
A firewall protects the outer boundary, but cannot control activity after an attacker gains entry. Phishing emails, third-party remote access and weak passwords can bypass perimeter controls. Real-name access and behaviour logging cover the blind spots inside the perimeter.

Q: Are backup recovery drills necessary even if backups exist?
Yes. Public cases this year show some organisations maintained backups but never tested restoration against the ransomware strain they encountered. Teams had to hunt for backdoors during recovery, extending downtime to six weeks. Backups without recovery drills are effectively useless.

Q: What is the relationship between internet access logs and industrial control security?
They are separate requirements. Internet logs record user internet activity for audit and compliance, while OT security safeguards production control systems. Factories need both, and one cannot replace the other.