Manufacturing blocks more ransomware encryption, but faces rising data theft extortion: Sophos

Sophos released its State of Ransomware in Manufacturing and Production 2025 report on December 9, revealing improved defenses in the sector. Encryption rates fell to 40%—the lowest in five years—from 74% last year, with 50% of attacks stopped before encryption, more than double the previous figure. However, adversaries shifted tactics: extortion-only attacks rose to 10% from 3%, and 39% of encrypted cases involved data theft.

ransomware encryption

Despite progress, 51% of affected manufacturers paid ransoms, with a median payment of US$1 million. Recovery costs dropped 24% to US$1.3 million, and 58% recovered within a week. Sophos X-Ops identified 99 threat groups targeting manufacturing, with Akira, Qilin, and PLAY most prominent.

“Manufacturing’s interconnected systems make downtime costly, driving attackers to double extortion,” said Alexandra Rose, Director of Threat Research at Sophos. The company urges layered defenses, vulnerability management, and 24/7 monitoring to counter evolving threats.

Business News