Hackers are changing their playbook as manufacturers strengthen cyber defences, shifting away from traditional file-encrypting ransomware toward data theft and pure extortion. That is the key finding of a new Sophos report, which shows attackers adapting quickly to improved detection across the manufacturing sector.
According to Sophos’ State of Ransomware in Manufacturing and Production 2025 report, just 40 percent of ransomware attacks on manufacturers resulted in encrypted data this year. That marks the lowest level in five years and a sharp fall from 74 percent in 2024. While more attacks are being stopped early, cybercriminals are increasingly stealing sensitive data to retain leverage over victims.
Extortion-only attacks rose to 10 percent, up from just three percent a year earlier. Sophos said data theft is now a core pressure tactic, with 39 percent of manufacturers hit by encryption also reporting data exfiltration. That rate is among the highest across all industries surveyed.
Despite stronger defences, ransomware remains costly. Sophos found that 51 percent of manufacturers whose data was encrypted still paid a ransom. The median payment stood at $1 million, only slightly below the median demand of $1.2 million. Attackers continue to exploit the fact that manufacturing operations rely on tightly connected systems, where even brief downtime can halt production and disrupt supply chains.
Sophos said early detection has improved significantly. Half of manufacturers reported stopping attacks before any data could be encrypted, more than double last year’s figure of 24 percent. However, the pressure of potential disruption continues to drive difficult decisions during active incidents.
The report also highlights persistent internal weaknesses. About 42 percent of manufacturers cited a lack of in-house cybersecurity expertise as a factor in attacks. Another 41 percent pointed to unknown security gaps, while the same share blamed inadequate protective measures. On average, organisations identified three internal issues that contributed to a breach.
Recovery is getting faster and cheaper, but not without consequences. Average recovery costs, excluding ransom payments, fell by 24 percent to $1.3 million. Fifty-eight percent of organisations said they recovered within one week, up from 44 percent last year. Even so, attacks took a toll on people and leadership. Nearly half reported higher staff stress after an encryption incident, and 27 percent said an attack contributed to leadership changes.
Sophos’ threat intelligence teams tracked 99 ransomware groups targeting manufacturing in the past year. In more than half of emergency response cases, attackers both stole and encrypted data, reinforcing the growing dominance of double-extortion tactics.
Sophos urged manufacturers to reduce risk by fixing root vulnerabilities, strengthening endpoint security, testing incident-response plans, maintaining reliable backups, and adopting continuous monitoring to counter increasingly adaptive attackers.
