Factory Cyberattacks 2026: Lines Stopped, PLCs Untouched
The short answer
In summer 2026, a ransomware attack made Coca-Cola suspend US production at its Fairlife dairy business, and a cyber incident at Boston Scientific disrupted manufacturing, order processing and shipping. Dragos counted 1,140 ransomware incidents against industrial organisations in Q2 2026, 747 (65%) of them in manufacturing. The common lesson: attackers stop production by hitting enterprise IT, the systems the plant depends on for orders, recipes and shipping, without ever reaching a PLC. Defending a plant therefore means planning for the day IT is down, not only locking the control network.
What happened
Fairlife, July 2026
Coca-Cola suspended US production at its Fairlife dairy unit after a ransomware attack discovered on 16 July 2026. Canadian operations were not affected, and the company disclosed the attack in an SEC filing, as Cybersecurity Dive reported on 17 July 2026.
Boston Scientific, August 2026
Boston Scientific found a cybersecurity incident on 25 August 2026 that disrupted access to systems supporting its operations, including processing and shipping orders, according to its SEC Form 8-K filed on 26 August 2026. The company said manufacturing was affected and that the unauthorised access was "limited to select internal-facing IT infrastructure". It brought in CrowdStrike, and shipping began to be restored by early September, as MedTech Dive reported on 4 September 2026.
Read that phrase again: internal-facing IT infrastructure. A maker of medical devices had its manufacturing affected by an attack on IT.
The numbers behind them: Dragos Q2 2026
The industrial security firm Dragos published its quarterly ransomware figures, reported by Help Net Security on 11 August 2026:
| Measure | Q2 2026 |
|---|---|
| Ransomware incidents against industrial organisations | 1,140 (up 12% from 1,020 in Q1) |
| Of which manufacturing | 747 (65%) |
| Most active groups | Qilin (140), Akira (129), The Gentlemen (125) |
| Incidents in Asia | 172 |
Dragos' central point: attackers disrupt production through enterprise IT, not by reaching the industrial control system.
Why a line stops when the PLC is fine
This surprises many automation engineers. The PLC is running, the HMI is up, the drives are healthy, and yet the plant manager orders a shutdown. The reasons are almost always one of these:
- No orders, no schedule. Production plans come from ERP. If ERP is encrypted, nobody knows what to make.
- No recipes or batch records. In food, dairy and pharma, the MES or batch system issues recipes and records each batch. Without records, product cannot legally be released, so making it is pointless.
- No traceability. Medical devices and food need lot traceability. Labels, serial numbers and quality records often come from IT systems.
- No shipping. Warehouse and logistics systems are IT. Finished goods pile up with nowhere to go.
- Fear of spread. If IT and OT networks are flat or loosely joined, the safest decision is to disconnect and stop until someone proves the control network is clean. That decision alone can cost days.
Point 5 is the one an automation engineer controls. If you can show, with drawings and firewall rules, exactly what crosses between IT and OT, management can keep running with confidence instead of pulling the plug.
What an automation engineer can actually do
You cannot fix your company's email security. You can make the plant survive an IT outage and make the boundary defensible.
1. Know and draw the IT/OT boundary
List every connection between the control network and the office network: historian links, MES interfaces, remote access, engineering laptops, file shares used for recipes. The IEC 62443 model of zones and conduits is the standard way to do this; our zones and conduits guide walks through it. A demilitarised zone (DMZ) between IT and OT, with the historian or data broker sitting in it, is the common pattern.
2. Plan for running without IT
Agree in advance, with production and quality, what the plant does if ERP and MES are gone for three days:
- Can recipes be loaded locally from a verified copy on the HMI or SCADA server?
- Can batch records be kept on paper or locally and back-filled later?
- Which lines can run safely, and which must stop?
3. Back up what you own
PLC programs, HMI projects, SCADA configurations, drive parameters and switch configurations: keep current copies offline, dated, and tested by restoring them to a spare or a simulator. Ransomware that reaches an engineering workstation will happily encrypt the only copy of your TIA Portal project.
4. Lock down engineering workstations and remote access
The engineering laptop is the bridge between worlds. Keep it patched, do not use it for email and browsing, and make remote access go through one controlled path with individual accounts and logging, switched on only when needed.
5. Watch the boundary
Logs from firewalls, remote-access gateways and Windows servers in the OT zone are only useful if someone reads them. That is where security monitoring tools such as Splunk come in, and why OT teams increasingly work with a security operations centre (SOC).
What it means for Indian engineers and jobs
Asia had 172 of Dragos' Q2 incidents. Indian manufacturing runs the same ERP, MES and Windows-based SCADA stacks as the plants in these headlines, often with flatter networks. Three skill combinations are getting more valuable:
| Combination | Why it is in demand |
|---|---|
| PLC or SCADA engineer plus networking | Can design and defend the IT/OT boundary instead of handing it to IT |
| SOC analyst plus OT knowledge | Can tell a normal Modbus or PROFINET pattern from an attack, which most IT analysts cannot |
| Controls engineer plus IEC 62443 | Can speak the language auditors, insurers and EU customers now use |
The common thread is networking. If you cannot read an IP plan, a VLAN design or a firewall rule, you cannot take part in the decision that matters most in an incident: whether the plant keeps running. Our post on PROFINET, PROFIBUS and Modbus TCP and the Modbus RTU explainer cover the industrial protocols you will need to recognise in logs.
Learn it free
Four of our free courses build the skills in this article:
- OT and ICS Cybersecurity with ISA/IEC 62443: zones, conduits, the DMZ and how to structure an IT/OT boundary.
- Cybersecurity for PLC Programmers: hardening controllers, protecting projects and handling backups.
- Computer Networking and CCNA 200-301 Prep: IP, VLANs, routing and firewalls, the base of everything above.
- SOC Analyst Level 1 with Splunk: reading logs and spotting an attack, the monitoring half of the job.
Each is free with an account, self-paced, with written notes, practice tasks and a final assessment. The optional EDWartens Certificate of Completion has a public verification code; it is not a vendor or Cisco certification. More at /free-courses.
Frequently asked questions
Q: Why did Coca-Cola stop production at Fairlife in 2026?
A: Coca-Cola suspended US production at its Fairlife dairy unit after a ransomware attack discovered on 16 July 2026. Canadian operations were not affected.
Q: What happened in the Boston Scientific cyberattack?
A: An incident found on 25 August 2026 disrupted systems supporting operations, including order processing and shipping, and affected manufacturing. The company said access was limited to select internal-facing IT infrastructure, and shipping began to be restored in early September.
Q: How many ransomware attacks hit industrial companies in Q2 2026?
A: Dragos recorded 1,140, up 12% from 1,020 in Q1. Manufacturing accounted for 747, or 65%.
Q: Can ransomware stop a factory without infecting the PLC?
A: Yes. Plants depend on IT systems for orders, recipes, batch records, traceability and shipping, and a flat network often forces a precautionary shutdown. Dragos' Q2 analysis found that this route, through enterprise IT, is how attackers disrupt production.
Q: What is the single most useful defence for an automation team?
A: Offline, tested backups of every PLC, HMI and SCADA project, combined with a documented IT/OT boundary so the plant can keep running safely while IT recovers.
Learn this, free
The courses that teach this
Every lesson, the written notes and the practice are free with an account. Only the certificate is optional and paid.
