How Cyber Risk Can Disrupt Connected Plant Operations

As plant operations become increasingly connected through the convergence of IT and OT, cyber risks are no longer solely an IT concern. Cyberattacks can disrupt devices, interfere with control systems, and trigger supply chain ripple effects, so plants must treat cybersecurity as a vital part of daily operations.

Threats are also growing in volume and sophistication. For example, in 2025, 119 ransomware groups targeted 3,300 industrial organizations, up from 80 the previous year. More than two-thirds of these victims were in the manufacturing industry.

Put simply, plants are highly attractive to hackers, and broader attack surfaces are considered easier to breach. And because plant downtime is so costly, attackers already know plants are under pressure to restore operations as soon as possible. That makes them prime ransomware targets.

This guide explores how phishing and IT outages affect connected plant operations, explains why vendor access vetting matters, and outlines ways plants can recover from attacks.

When Phishing Leads to a Compromised Account

Phishing is a common cyberattack in which a plant employee or operator is tricked into sharing sensitive information or granting internal systems access.

It is traditionally carried out through seemingly legitimate emails, but voice and SMS attacks increasingly show up in multi-channel phishing trends as attackers try to reach staff beyond the inbox. For instance, vishers, or voice phishers, contact help desks posing as employees to reset passwords.

Phishing remains one of the most common ways in for broader attacks. Cisco Talos’ 2025 research found that phishing was used for initial access in 40% of the cyber incidents it reviewed, with 35% of those cases involving internal phishing via compromised accounts. For plants, that means a phishing attack may come from a colleague’s real account.

In a plant, a single stolen login can let an attacker access emails, VPN connections, and ERP and scheduling systems, especially where single sign-on links them all together.

The rise of AI also makes phishing harder to spot. AI-generated emails rarely contain telltale spelling or grammar mistakes, so organizations need more in-depth training and awareness-building. ENISA’s 2025 Threat Landscape Report states that, by early 2025, more than 80% of social engineering activity observed globally involved AI-supported phishing.

Successful phishers can steal credentials, move laterally across networks, and, in some cases, reach and manipulate systems that control production and machinery, or deploy ransomware to halt production completely.

Because phishing involves human error, protecting plants starts with regular drills and scenario training. Other preventive measures include:

Using phishing-resistant multi-factor authentication (MFA)
Building a culture of reporting and enabling staff to do so quickly and easily
Establishing strict identity checks and two-person authorization for password and MFA resets, alongside zero-trust principles

How an IT Outage Affects the Production Floor

With IT and OT converging, a cyberattack no longer affects only data security; it can also disrupt ongoing operations. IT outages can cause line freezes, safety issues, and potential revenue loss from extended downtime.

Even if machines aren’t directly attacked, production can halt as a precaution. Freezes can also occur if the systems used to schedule and ship orders go down.

When IT and OT aren’t effectively separated or are poorly managed, IT incidents can spread toward production floors. Many legacy OT systems were designed to run for decades at a time, long before IT connectivity, so they are especially exposed unless secured with that connectivity in mind.

The costs of downtime caused by production lockdowns also spread beyond the plant to suppliers, dealers, retailers, and, ultimately, customers. The longer a threat goes unseen or unmanaged, the higher the costs climb and the more damage it can do to a plant’s reputation.

Why Unchecked Vendor Access Is a Risk

Many plant operations rely on third-party vendors to maintain access to certain systems for remote maintenance, which can lead to shared logins and dormant accounts (an easy route for attackers).

If an attacker steals a vendor login, they also steal that vendor’s access. In turn, one compromised supplier can open the door to several connected customers.

Few plants are likely to keep comprehensive lists of who can connect and to what extent. The World Economic Forum’s Global Cybersecurity Outlook 2026 found that just 66% of organizations evaluate supplier security maturity, 27% simulate cybersecurity incidents, and 33% fully map supply chain ecosystems to assess threat exposure.

Ways to tighten and protect vendor access include:

Enforcing the principle of least privilege (i.e., restricting vendor access and permissions to what each job requires)
Limiting vendor access to time-limited sessions that are manually approved
Applying zero-trust principles so all connections are verified, not trusted by default
Logging all access requests, reasons, and outcomes, and regularly reviewing records
Removing dormant and expired accounts at the end of vendor partnerships and projects
Requiring MFA across all accounts, including remote access

Keeping Operations Moving During Recovery

Plants can rarely stop and restart processes cleanly, meaning IT and OT teams need to establish a workable recovery plan before incidents occur.

This typically starts with prioritizing the most critical lines, products, and customers. Critical services may need to run at a reduced level, with the systems, people, and connections required to keep them running. Some devices may need to be disconnected and networks segmented to prevent threats from spreading.

Recovery takes longer than containment, so it’s vital to plan for the most efficient restoration possible. Keeping offline backups of critical data such as PLC configurations and recipes is always recommended.

It is just as important to test manual and offline processes so the plant doesn’t rely on IT to restore everything after an incident. A plant with well-rehearsed manual backup processes may move more slowly than usual, but can keep critical lines running while issues are resolved.

A safe, effective recovery requires a gradual restart, meaning each system and connection should be tested and verified before going back online. Clear communication among staff, suppliers, and customers should support these processes.

Cyber threats can cause serious operational downtime for unprepared plants, and attacks are growing more sophisticated and prevalent. With careful, realistic planning, plants can limit damage, recover faster, and make cyber resilience a key part of daily operations.

Publish Your Article