Ransomware disrupts industrial production through IT systems, not control systems: Dragos
This digest was compiled by AI from multiple sources — links to the originals are below.
Dragos reported 1,140 ransomware incidents against industrial organizations in Q2 2026, up 12% from Q1, with manufacturing accounting for 747 of them. Researchers stressed that attackers can disrupt operations by targeting enterprise IT systems like ERP and remote access gateways without breaching industrial control systems. Even as extortion shifts to data theft, such IT-focused attacks risk cascading production shutdowns.
Incident Surge and Sector Breakdown
Dragos recorded 1,140 ransomware incidents in Q2 2026, a 12% rise from 1,020 in Q1. Manufacturing was the hardest hit with 747 incidents (65%), followed by construction (176), equipment manufacturing (114), and food and beverage (70). Organizations supporting industrial environments — engineering firms, integrators, equipment makers — accounted for 117 incidents, while transportation and logistics saw 95.
IT as Gateway to OT Disruption
Dragos found that ransomware attacks do not require direct access to industrial control systems to halt production. The Mackay Sugar cyberattack in June 2025 halted milling at two Queensland mills, with attackers likely compromising enterprise IT rather than OT. Researchers assessed with low confidence that the shutdown stemmed from IT disruption or containment measures, highlighting the cascading impact from systems like ERP, virtualization platforms, and remote access tools.
Shift to Data Theft Extortion
Extortion tactics are moving from file encryption to data theft, Dragos noted, exposing organizations even after system restoration. Attackers often gain entry through internet-facing devices, compromised accounts, and stolen credentials. The Qilin group logged 140 industrial victim claims (down from 198 in Q1), while Akira rose to 129 and The Gentlemen to 125, indicating persistent activity from multiple groups.
What's Next
Dragos expects ransomware groups to increasingly exploit IT-OT convergence points to trigger production halts. Whether sectors beyond manufacturing, such as energy or water, will see similar disruption levels remains an open question.
1 source
Ransomware disrupts industrial production through IT systems, not control systems: Dragos
