About 10 days before ransomware hit a Japanese beer and beverage maker in September 2025, attackers slipped into its network through equipment at one of its sites. They used a weak password to gain administrator rights. Then they explored its servers, mostly after business hours. On September 29, they encrypted its systems. Production stopped, and orders and shipments took months to return to normal. Qilin claimed the attack.

All the attackers needed was one entry point and one weak password. Most factories have entry points like that, and they rarely look like a problem. The controller still works. The supplier’s remote access saves time. Each upgrade keeps production moving. But those same connections can let attackers spread from one compromised system to another, halting production, delaying shipments, and exposing designs and formulas.

That’s manufacturing security debt, and it’s coming due. Black Kite recorded 1,183 disclosed manufacturing ransomware incidents through July 29, 2026, up nearly 40% from the same period in 2025.

“Manufacturing is transforming faster than its security,” said Trevor Dearing, director of critical infrastructure solutions at Illumio. Every upgrade and delayed fix widens that gap. Closing it will take time. In the meantime, manufacturers can limit how far an attacker can spread while production keeps running. Here’s where the risk hides and how to contain it.

While factories evolve, security falls behind

“The risk isn’t just the age of a machine,” Dearing said. “It’s what has access to it, and what attackers can reach.”

Industrial Cyber’s September reporting on operational technology (OT) security debt described plants where old and new systems share flat networks. With few internal barriers, attackers can move from one compromised system to the next. Shared passwords and open supplier access add to the risk.

Even advanced factories carry this debt. Semiconductor Equipment and Materials International, or SEMI, described semiconductor plants where equipment built to last decades now connects to cloud analytics and remote support. Outdated network maps can leave plant teams unaware of the paths an attacker could use to reach production systems.

Qilin attacks put manufacturers under pressure

On October 8, 2026, Japan’s National Police Agency announced that Japanese police had detained a Russian national suspected of leading the Qilin ransomware group and handed him over to Germany.

The announcement drew attention to one of manufacturing’s most active ransomware threats. Black Kite linked Qilin to 178 manufacturing ransomware incidents in the first seven months of 2026 — the highest count for any group in its dataset during that period.

Qilin runs a ransomware-as-a-service business: operators provide the malware, and affiliates launch attacks for a share of the ransom. Affiliates steal files and lock systems. Victims then face demands to pay for restored access and to keep stolen files from being published.

These selected attacks show Qilin’s reach and impact across manufacturing:

• November 2023: A cyberattack hit an automotive parts supplier. The disruption stopped some assembly lines at a carmaker it supplied. While Qilin claimed responsibility for the attack, the supplier hadn’t confirmed the claim when the report was published.
  
• September 29, 2025: A ransomware attack hit a Japanese beverage maker and halted production. Beer production resumed within days. Orders and shipments took months to return to normal.
  
• September 2026: A ransomware attack hit an electronics manufacturer. Files on its servers were locked. The company disconnected its internal network. The attack was linked to Qilin, but the company hasn’t named the group.

Access is what lets these attacks spread. Cisco Talos observed Qilin attackers stealing credentials, moving between systems, and encrypting files across network shares. For manufacturers, limiting an attacker’s reach can keep one breach from disrupting the entire plant.

More connections, more room for lateral movement

“An engineering workstation can be connected to far more of the factory than an individual controller,” Dearing said. “If an attacker takes over that workstation, the question is what else they can reach from it. That’s why those systems need so much attention.”

Historians, domain controllers, manufacturing execution systems, and OPC servers can also provide broad access. A count of software flaws won’t show that reach. A device with strict access limits poses far less risk than a workstation linked to several production areas.

“You need to know what each system is connected to and what it needs to connect to,” Dearing said. “Look at the protocols as well. Is remote desktop running somewhere it shouldn’t be? You can’t build the right policy until you understand those connections.”

Start with processes whose failure would stop production or create unsafe conditions. Map their supporting systems, supplier access, and cloud connections. Then remove unnecessary access paths.

Protect what you can’t patch

“If you can’t patch a device today, you still need to control what can reach it,” Dearing said. “Map the connections it needs, restrict everything else, and put additional controls in front of it where you can. The device’s age doesn’t make that work optional.”

Some upgrades require a shutdown, supplier approval, or new hardware. Other safeguards can reduce risk while that work waits.

Joint guidance on secure OT connectivity, released in January 2026 by the UK’s National Cyber Security Centre (NCSC), CISA, the FBI, and other international partners, recommends controlled remote access and migration toward secure industrial protocols.

“The equipment supplier may need access to service the machine,” Dearing said. “That access should go through a gateway you control. It shouldn’t become blanket access to your manufacturing environment.”

Define which equipment a supplier’s engineer can reach and when. Authenticate the user and monitor the session. For equipment awaiting patches, segmentation policy or a firewall with intrusion prevention can add another layer.

Test communication rules with plant engineers and suppliers before enforcing them. Give obsolete equipment a replacement timeline; temporary controls need a plan beyond the next maintenance window.

Turn security findings into fixes

“The security team and the production team have to understand the same environment,” Dearing said. “If one team understands the threat but not the process, and the other understands the process but not the exposure, there’s a gap in how the factory is being protected.”

Industrial Cyber’s reporting on stalled OT remediation found that unclear ownership and funding issues often block progress. A report can find the right problems without giving anyone the power to fix them.

Turn priority findings into funded work. Name an owner. Explain what could happen to production. Schedule changes around planned maintenance. Set completion dates. Where fixes must wait, document the remaining risk and when leadership will review it.

Know what you can safely cut off

Dearing says to start with a boundary between IT and OT. It should allow required business communications while limiting an attacker’s reach into production.

“You need to decide in advance what you’ll isolate if something goes wrong,” he said. “If you wait until the attack is happening, you’re trying to work out the dependencies at the worst possible moment. Build the plan and test it before you need it.”

The joint OT connectivity guidance recommends testing isolation plans and identifying essential data flows. Check what happens when a supplier link fails. What if a business application or shared service goes down? Some processes may continue safely. Others may require a controlled shutdown.

Pay down the debt before it comes due

Security debt comes due the day an attacker finds a path the plant forgot to close. Few manufacturers can pay it all off at once. They can keep it from compounding. Every maintenance window, supplier renewal, and equipment upgrade is a chance to close an access path and fund the changes that can’t wait. Do that steadily, and the next breach stays contained to one system instead of stopping the line.

Don't let one breach shut down your production line

Outdated systems and growing connectivity don't have to put your entire operation at risk. Illumio helps manufacturers contain breaches, stop lateral movement, and protect critical production systems without disrupting operations.

Illumio Protects Manufacturing Operations

See Illumio Segmentation in Action