Huntress Report: Manufacturing Attacks Jumped to 17% of Total Incidents in 2025

Huntress research indicates that manufacturing represented approximately 17% of all cyber attacks in 2025, a notable increase from the 9% share recorded in 2024. This surge highlights a growing vulnerability in industrial sectors as threat actors shift their focus toward disrupting physical production environments.

The primary driver behind this trend is ransomware groups targeting uptime instead of merely exfiltrating data. According to Huntress, attackers recognize that while organizations may survive short-term data loss, they cannot sustain halted assembly lines. This strategy aims to maximize financial pressure through operational paralysis.

Operational Technology at Risk

Threat actors are moving beyond office networks to compromise operational technology (OT) systems that control machinery. Huntress notes that this shift exposes manufacturers to missed shipments, idle labor costs, and complex restart procedures. Safety risks also increase, as sudden shutdowns can damage sensitive equipment or create hazardous conditions for plant workers.

The push for smart factories has eliminated the traditional air gaps that once isolated industrial control systems (ICS) from corporate networks. Remote maintenance access, Industrial Internet of Things (IIoT) sensors, and cloud dashboards have merged these environments. Consequently, attackers no longer need physical access to a plant to reach critical systems.

Attack Paths and Zero Trust

A common attack path begins with a phishing email to a department like Sales or Finance, providing initial access to a corporate laptop. Attackers then scan for bridges, such as jump servers or vendor VPN appliances, to reach manufacturing systems. Without strict segmentation, they use stolen credentials to enter the OT environment.

Once inside the OT network, attackers target Manufacturing Execution Systems, Human-Machine Interfaces, or Programmable Logic Controllers. Huntress reports that this access allows them to alter recipe values, stop conveyor belts, or disable safety sensors. This capability turns a standard network breach into a physical production crisis.

What should you do?

Organizations should audit their network segmentation to ensure strict boundaries exist between corporate IT and operational technology environments. Monitoring for unusual lateral movement from office networks to OT systems can help detect early intrusion attempts.

What to do and how to stay safe: Huntress

• Implement Zero Trust principles to verify every connection, including sensors and vendor access, before granting permissions.
• Enforce strict network segmentation to prevent attackers from moving from compromised office laptops to OT systems.
• Monitor for unauthorized access to jump servers or VPN appliances that bridge corporate and manufacturing networks.
• Train employees in non-IT departments to recognize phishing attempts that could serve as initial footholds for attackers.

Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How much did manufacturing cyber attacks increase in 2025?

Manufacturing accounted for 17% of cyber attacks in 2025, compared to 9% in 2024, according to Huntress research.

Why are attackers targeting OT systems instead of data?

Attackers target OT to halt production, causing immediate financial losses through missed shipments and idle labor, which is more impactful than data loss.

How do attackers reach isolated manufacturing systems?

Attackers often start with phishing emails to corporate staff, then use network bridges or lack of segmentation to hop into OT environments.