Sophos Report: Manufacturing Industry Blocks More Ransomware Attempts, While Adversaries Shift to Data Theft
Sophos, a global leader of innovative security solutions for defeating cyberattacks, today announced new findings from the Sophos State of Ransomware in Manufacturing and Production 2025 report. The report is based on an independent survey of 332 manufacturing organizations that were hit by ransomware in the last year.
The report reveals that ransomware attacks on manufacturers are now less focused on data encryption. Instead, attackers are increasingly stealing data and using it to extort victims. In many cases, even when systems are encrypted, data is also stolen, which doubles the impact on organizations. Although more companies are able to stop attacks before files are locked, more than half of those that do get encrypted still end up paying ransoms close to the original amount demanded.
At the same time, recovery costs and timelines are improving, with average restoration expenses falling. Most organizations now recover fully within about a week, even without counting ransom payments. Yet, manufacturers still point to internal weaknesses, limited in‑house expertise, unknown security gaps, and insufficient protection tools as key reasons attacks succeed. These issues increase stress on IT and security teams, raise pressure from senior leadership, and can even trigger leadership changes after an incident.
Strengthening Defenses for the Long Term
Based on its experience protecting manufacturing organizations worldwide, Sophos recommends the following best practices to help businesses stay ahead of ransomware and other cyberthreats:
● Eliminate Root Causes: Take proactive steps to address common technical and operational weaknesses such as exploited vulnerabilities that adversaries frequently target. Solutions like Sophos Managed Risk can help organizations assess their exposure and reduce risk across their environments.
● Defend Every Endpoint: Ensure all endpoints, including servers, are protected with dedicated anti-ransomware defenses to prevent attacks from gaining a foothold.
● Plan and Prepare: Establish and routinely test a comprehensive incident response plan. Maintain reliable backups and practice data restoration regularly to minimize downtime in the event of an attack.
● Monitor Around the Clock: Continuous visibility is essential. Organizations without in-house resources can strengthen their resilience by partnering with a trusted Managed Detection and Response (MDR) provider for 24/7 threat monitoring and expert response.
DBTech/desk
