Manufacturing cyber incidents by year and record status
| Year | Incident | Where | Record status |
|---|
| 2014 | German Steel Mill | Germany (site unnamed) | Victim and attacker unnamed |
| 2019 | Norsk Hydro | Norway and global | Attacker not named by any court |
| 2022 | Toyota | Japan | Supplier incident; attacker undisclosed |
| 2022, 2025 | Bridgestone | North and Latin America | 2022 claimed by LockBit; 2025 undisclosed |
| 2023 | Ingersoll Rand | Global | Vector and actor undisclosed |
| 2025 | Nucor | North America | Vector and attacker undisclosed |
| 2025 | Jaguar Land Rover | United Kingdom and global | Claimed; never officially attributed |
| 2023 | Clorox | United States | Vector alleged in litigation |
| 2023 | MKS Instruments | United States and global | Attacker undisclosed |
| 2026 | West Pharmaceutical | Global | Attacker undisclosed |
| 2026 | Stryker | United States and global | Claimed by Handala |
| 2023 | Johnson Controls | Global | Claimed, per reporting |
What the headlines got wrong about manufacturing cyberattacks
One widely repeated claim from each entry, and what the record says. Each entry lists more, with sources.
| Widely repeated claim | What the record says | Entry |
|---|
| "Russian hackers attacked a German steel mill." | A 2015 Bloomberg report said "now being attributed to Russian hackers" and named no attributing body. No government attribution was found. | German Steel Mill |
| "Norsk Hydro expecting $69m hit from cyber attack." | Hydro never gave a dollar figure. The $69 million was a trade publication's conversion of a first-quarter estimate plus a second-quarter forecast. Hydro kept counting: around NOK 650 to 750 million for 2019, and around NOK 800 million in total. | Norsk Hydro |
| "The shutdown cost Toyota about $375 million." | Bloomberg's own "rough calculation of its sales and output data," not a Toyota figure and not a disclosed cost. | Toyota |
| "The 2022 attack cost $100 million to $150 million." | Undisclosed. The parent named the incident in its Q1 2022 slides with no figure, and we cannot find where the range came from. | Bridgestone |
| "Ingersoll Rand was hit by Stormous ransomware." | Ingersoll Rand names no actor and no malware. A Stormous listing is a claim, dated a month before detection by one tracker, and never linked to the incident. | Ingersoll Rand |
| "Nucor had to shut down OT." | Both filings describe IT systems only. Nucor described the halt as proactive and made "in an abundance of caution"; "had to" turns a choice into a compulsion. | Nucor |
| "It started with a vishing call to the JLR IT helpdesk." | No identifiable source. Never stated by JLR, the government, Parliament or any regulator. The minister who described helpdesk tricks added: "I am not saying that that is what happened in this case." BlastWave published this as fact and withdrew it on 1 September 2026. | Jaguar Land Rover |
| "The Clorox cyberattack cost $356 million." | $356M is in no Clorox filing. The filed net sales lines give a $354M quarterly sales decline, which is not a cost. The disclosed incremental cost was $49M through December 2023 and $57M through March 2024. | Clorox |
| "Chip company loses $250m after ransomware hits supply chain." | Applied Materials built a $250M estimate into its next-quarter outlook. It reported no loss, and its next results release does not mention the estimate. | MKS Instruments |
| "West Pharmaceutical was hit by ransomware." | West's filings since the incident never use the word. West said data was exfiltrated and systems encrypted; "ransomware" is the press's inference, and no group is on the record claiming it. | West Pharmaceutical |
| "Iran attacked Stryker." | Handala claimed it. The Justice Department says the MOIS used the Handala domain to claim credit for an attack on an unnamed firm. That is about the claim, not the deed. | Stryker |
| "Johnson Controls' manufacturing shut down." | The filings say "disruption to parts of the Company's business operations." "Manufacturing and everything is down" is one unnamed customer's secondhand account in press. | Johnson Controls |
BlastWave analysis: why the plants stopped
Analysis, not a disclosed factAcross the twelve entries, the public record rarely places an intruder on a plant control system; the 2014 steelworks is the exception. What stopped production elsewhere was the plants' dependence on business systems, such as order processing, shipping and supplier links, and the companies' own decisions to isolate those systems. That is BlastWave's reading of the record, not a finding of any investigator. It is also why the entries' recommendations focus on what a plant needs from the business network to keep running, and on removing the paths an intruder uses to reach it.
Frequently asked questions
What are the major cyberattacks on manufacturers?
The Manufacturing edition documents twelve: an unnamed German steelworks (disclosed 2014), Norsk Hydro (2019), Toyota's plant stoppage after a ransomware attack on supplier Kojima Industries (2022), Bridgestone Americas (2022 and 2025), MKS Instruments (2023), Ingersoll Rand (2023), Clorox (2023), Johnson Controls (2023), Nucor (2025), Jaguar Land Rover (2025), Stryker (2026) and West Pharmaceutical (2026).
Have hackers ever caused physical damage at a factory?
Germany's Federal Office for Information Security (BSI) reported in December 2014 that attackers reached an unnamed steelworks' production networks and that failing control components left a blast furnace unable to be shut down in a controlled manner, causing massive damage to the plant. The BSI named no company, date, attacker or malware. No other entry in this edition records physical damage to plant.
Why do factories stop production after a cyberattack on IT systems?
In this edition the stoppages mostly follow from dependence on business systems and from the companies' own containment. Norsk Hydro isolated its plants in 2019. Bridgestone Americas disconnected plants in 2022. Clorox moved order processing to manual procedures at a reduced rate in 2023. Nucor halted production "in an abundance of caution" in 2025. Jaguar Land Rover shut down its global systems in 2025.
How much did the biggest manufacturing cyberattacks cost?
Norsk Hydro estimates its total cost at around NOK 800 million. Clorox disclosed $49 million of incremental costs through December 2023; the widely quoted $356 million is a sales decline in no Clorox filing. MKS Instruments disclosed $15 million, net of recoveries, while the quoted $200 million was expected lost revenue. Jaguar Land Rover reported quarterly cyber costs and, in the releases read for its entry, no total.
Was Toyota hacked in 2022?
No record says a Toyota system was hacked. On 1 March 2022 Toyota stopped all 28 lines at its 14 plants in Japan for one day after a system failure at parts supplier Kojima Industries, which by its own account had been hit by ransomware through a subsidiary's vulnerable remote connection device. The attacker, malware family and cost are undisclosed.
How does Hackopedia verify a manufacturing incident?
Every figure, date and quotation in an entry traces to a company filing, a court record, a government or regulator document, the company's own dated statements, a named researcher's published work, or a dated publication named as such, and each was checked against its source by hand. Claims resting on press, trackers or unnamed sources are marked as reported, and errors in Hackopedia's own first volume are corrected on the page.
Other editions
Cite this page
BlastWave. “Cyberattacks on Manufacturers: The Verified Record (2014 to 2026).” Hackopedia, Volume 2, Manufacturing edition. Last verified 28 September 2026. https://hackopedia.blastwave.com/manufacturing/
Revision history
| Date | Change |
|---|
| 5 Oct 2026 | Manufacturing edition published with twelve entries. FILE numbers run across all of Hackopedia Volume 2, not by edition. |
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry