When people picture a cyberattack on a manufacturer, they usually imagine someone taking control of a machine on the plant floor. That does happen. It isn't how most production stops.
More often, the line stops because the systems around it go dark. The ERP that releases work orders. The quality system that signs off a batch. The label printer that won't print without a server. The identity platform every engineer logs in through. The machines may be fine. The plant still can't run.
This year has given two clear examples, both from medical technology manufacturers. This article looks at what they show, why manufacturing stays the most-targeted industry, and what IT and operations leaders can do now to shorten a bad day.
The Problem: Manufacturing Is the Most-Targeted Industry, and Downtime Is the Point
Manufacturing has topped IBM X-Force's ranking of most-attacked industries for five consecutive years.
Industrial cybersecurity firm Dragos sees the same pattern. It tracked 119 ransomware groups targeting industrial organizations in 2025, up from 80 in 2024. Those groups affected about 3,300 organizations, and manufacturers made up more than two-thirds of the victims (Dragos, Feb 17, 2026).
The reason isn't complicated. Manufacturers have very little tolerance for downtime. Every hour a line stands still means lost output, missed shipments and unhappy customers. Attackers know that pressure makes a fast payment more likely.
What 2026's Medtech Incidents Show
Stryker, March 2026
On March 11, Stryker identified an attack that caused a global disruption of its Microsoft environment. Order processing, manufacturing and shipping were disrupted. The company said it found no ransomware and did not believe its connected products or patient services were affected (MedTech Dive, Mar 13, 2026).
Reporting since then says the attackers compromised an administrator account, created a new global administrator, and used Microsoft Intune's built-in wipe command against employee devices. A week later, CISA urged organizations to harden their endpoint management systems (BleepingComputer, Mar 19, 2026).
Boston Scientific, August 2026
An attack on August 25 disrupted manufacturing, order processing and shipping. The company announced full restoration about two weeks later. Its CEO said it likely lost orders while plants and distribution centers were shut down, and that some hospitals ordered from competitors in that period. The company expects to miss its third-quarter and full-year guidance (MedTech Dive, Sep 11, 2026). Activating remote monitoring for some newly implanted cardiac devices was also affected during the outage (MedTech Dive, Aug 28, 2026).
Not just medtech
Jaguar Land Rover shut down its systems after a cyberattack in late summer 2025 and halted production for more than five weeks. The UK's Cyber Monitoring Centre estimated the cost to the UK economy at £1.9 billion, with up to 5,000 organizations affected, mostly in JLR's supply chain (Prolific North, Oct 23, 2025).
Our analysis: public reporting on the Stryker and Boston Scientific incidents describes disruption to business and IT systems, not to machine controllers. That's the lesson. The quickest way to stop a plant is to take away what it depends on.
Why This Happens: The Plant Floor Runs on IT
Ten years ago, many plants could run for days with corporate IT offline. That's rarely true now. Production depends on a chain of IT systems:
- Planning and execution: ERP, MES and scheduling release the work and track it.
- Quality and compliance: quality systems, batch records and traceability, which regulated manufacturers like medtech cannot skip.
- Shipping: order management, warehouse systems and label printing.
- Identity and management: the directory everyone logs in through, and the tools that manage every laptop and phone.
- Engineering access: Windows workstations that program and monitor the line.
That last group is easy to misclassify. Dragos notes that organizations often treat OT incidents as "IT only" because engineering workstations and operator screens run Windows.
The identity and management layer deserves special attention. Whoever controls the device-management console controls every device it manages. The Stryker incident showed what that means when an attacker holds administrator rights. A legitimate admin tool did the damage.
Practical Recommendations
None of these require a new platform. Most are decisions and discipline.
- Map production dependencies. For each site or line, list the IT systems it needs to produce, ship and stay compliant. Then note how long it can run without each one. Most manufacturers don't have this document, and it's the most useful one in an incident. CISA's OT asset inventory guidance, written with US and allied agencies, is a structured place to start.
- Treat admin tools as crown jewels. Device management, identity, backup consoles and virtualization platforms can each take down everything at once. Apply CISA's post-Stryker advice broadly: least-privilege admin roles, MFA and Conditional Access on privileged actions, and a second approver for destructive changes such as device wipes. Alert on any new global administrator.
- Separate the plant from the corporate network. Segment plant systems from office systems, and control the few paths between them. Where practical, avoid having plant access depend on the same accounts used for email. NIST SP 800-82 Rev. 3 is the standard reference for OT security architecture.
- Make recovery attacker-resistant. Keep immutable or offline copies of identity, ERP and MES configurations, and machine programs. Test restores on a schedule. A backup an attacker with admin rights can delete is not a recovery plan.
- Plan for manual operations. Decide in advance what the plant can do without IT, for how long, and who decides. Print the documents a shift would need. Run a tabletop exercise with operations, not just IT.
- Get visibility into the plant network. Dragos reports that organizations with comprehensive OT visibility contained OT ransomware in an average of 5 days, against an industry average of 42.
- Bring suppliers into the plan. The JLR case showed that one manufacturer's outage becomes its suppliers' outage. Know which vendors have remote access to your plant, and what you would do if a key supplier went down.
The IT Leadership Perspective
Our view: in manufacturing, cyber risk is operations risk. It should be owned jointly by the COO and the CIO, and measured in hours of lost production, not in the number of tools deployed.
That changes the questions leadership asks. "Are we secure?" can't really be answered. "How long until we ship again if identity goes down?" can. So can "Which three systems would stop every line?"
It also changes where the next dollar goes. For many mid-market manufacturers, hardening identity and admin tools and proving recovery will reduce more downtime than another detection product.
For medtech and health-tech manufacturers, the stakes reach further. When Boston Scientific's plants stopped, hospitals felt it. When a supplier to healthcare can't ship, care teams have to find another way.
Where ITSN Fits
ITSN works with manufacturing, healthcare and health-tech organizations as a vendor-neutral partner. Our security and compliance practice covers security assessments and gap analysis, zero-trust and network security, identity and access management, continuous monitoring and threat detection, and incident response planning. The aim is protection that fits production reality rather than slowing it down.
A practical first step is a dependency and resilience review. We map what your lines rely on, test how recoverable those systems are, and give you a prioritized list of fixes. When you need extra hands, our staff augmentation team provides network and security specialists who work inside your processes.
Conclusion
The 2026 medtech incidents weren't stories about sophisticated attacks on machines. They were stories about how much a plant depends on ordinary IT systems, and how long it takes to restore them.
You can't promise your board that an attacker will never get in. You can know which systems your production depends on, protect the tools that control them, and prove you can bring them back.
Frequently Asked Questions
What is manufacturing cybersecurity?
It's the protection of a manufacturer's IT systems (ERP, email, identity) and operational technology (the controllers, workstations and networks that run production). It also covers the connections between them.
What is the difference between IT and OT security?
IT security protects business systems and data. OT security protects the systems that control physical processes, where availability and safety come first. Modern plants depend on both, so the two need one plan.
Why are manufacturers targeted so often?
Manufacturers can't afford downtime, which gives extortion-focused attackers leverage. IBM X-Force has ranked manufacturing the most-attacked industry for five consecutive years.
How can a manufacturer reduce downtime from a cyberattack?
Map which IT systems production depends on, lock down admin tools, segment plant networks, keep attacker-resistant backups, and plan manual operations in advance.
Is NIST SP 800-82 required?
It's guidance, not a regulation, for most private manufacturers. It's widely used as the reference for securing OT systems.