BlastWaveBlastWaveHACKOPEDIA
Hackopedia • Manufacturing edition
12 files

Cyberattacks on Manufacturers: The Verified Record

Volume 212 entries188 sources citedAll verified since Updated

The Manufacturing edition of Hackopedia: twelve incidents at steel, aluminum, automotive, chip equipment, consumer goods, medical device and pharmaceutical makers, from 2014 to 2026. Each entry separates what is verified from what is only reported or unknown.

Summary

Hackopedia's Manufacturing edition covers twelve incidents from 2014 to 2026, from an unnamed German steelworks to West Pharmaceutical. Only the steelworks entry records physical damage to plant, reported by Germany's BSI. In many of the others, production stopped after the company shut down or isolated its own systems, and several widely quoted cost figures are not costs.

The twelve incidents in the Manufacturing edition

Sorted by file number. The tag says how far the public record goes, not how serious the incident was.

File 008 · 2014German Steel Mill Cyberattack (Disclosed 2014)Germany (site unnamed)

Attackers phished into an unnamed steelworks and reached its production networks; a blast furnace could not be shut down in a controlled manner, the BSI reported.

Victim and attacker unnamed
File 010 · 2019Norsk Hydro Ransomware Attack (2019)Norway and global

Ransomware spread across the aluminum maker's IT; plants were isolated, some ran with more manual work, and Hydro estimates the total cost at around NOK 800 million.

Attacker not named by any court
File 013 · 2022Toyota Plant Shutdown After Kojima Industries Ransomware Attack (2022)Japan

A system failure at supplier Kojima Industries, hit by ransomware, stopped all 28 lines at Toyota's 14 plants in Japan for one day; no record says a Toyota system was hacked.

Supplier incident; attacker undisclosed
File 014 · 2022, 2025Bridgestone Americas Cyber Incidents (2022 and 2025)North and Latin America

Plants were disconnected in 2022 to contain ransomware, and some stopped again in 2025 after a "limited cyber incident"; nothing shows a shared cause.

2022 claimed by LockBit; 2025 undisclosed
File 015 · 2023Ingersoll Rand Cybersecurity Incident (2023)Global

An incident disrupted several IT systems; the company later called it not material and has never disclosed the vector, the actor or any effect on production.

Vector and actor undisclosed
File 016 · 2025Nucor Cyber Incident and Production Halt (2025)North America

Unauthorized access to IT systems led North America's largest steel producer to halt production at various locations "in an abundance of caution"; it called the incident not material.

Vector and attacker undisclosed
File 023 · 2025Jaguar Land Rover Cyber Incident (2025)United Kingdom and global

Global systems were shut down and UK vehicle production stopped for about five weeks; how the attackers got in has never been officially stated.

Claimed; never officially attributed
File 036 · 2023Clorox Cyberattack (2023)United States

An intrusion forced manual order processing and paused production; the quoted $356M is a sales decline, and the disclosed cost was $49M through December 2023.

Vector alleged in litigation
File 037 · 2023MKS Instruments Ransomware Incident (2023)United States and global

Ransomware on business systems halted ordering and shipping at a chip-equipment supplier; the quoted $200M was expected lost revenue, the disclosed cost $15M net.

Attacker undisclosed
File 039 · 2026West Pharmaceutical Cyberattack (2026)Global

Data was exfiltrated and unnamed systems encrypted; West took its systems offline worldwide, and all sites restarted by 20 May.

Attacker undisclosed
File 040 · 2026Stryker Cybersecurity Incident (2026)United States and global

An intrusion into the corporate network disrupted order processing, manufacturing and shipping; nothing on the record says a production machine was reached.

Claimed by Handala
File 048 · 2023Johnson Controls Ransomware Incident (2023)Global

Ransomware reached part of a building technology company's internal IT and data was taken; it saw no evidence of impact to its digital products, based on information reviewed to date.

Claimed, per reporting

Manufacturing cyber incidents by year and record status

YearIncidentWhereRecord status
2014German Steel MillGermany (site unnamed)Victim and attacker unnamed
2019Norsk HydroNorway and globalAttacker not named by any court
2022ToyotaJapanSupplier incident; attacker undisclosed
2022, 2025BridgestoneNorth and Latin America2022 claimed by LockBit; 2025 undisclosed
2023Ingersoll RandGlobalVector and actor undisclosed
2025NucorNorth AmericaVector and attacker undisclosed
2025Jaguar Land RoverUnited Kingdom and globalClaimed; never officially attributed
2023CloroxUnited StatesVector alleged in litigation
2023MKS InstrumentsUnited States and globalAttacker undisclosed
2026West PharmaceuticalGlobalAttacker undisclosed
2026StrykerUnited States and globalClaimed by Handala
2023Johnson ControlsGlobalClaimed, per reporting

What the headlines got wrong about manufacturing cyberattacks

One widely repeated claim from each entry, and what the record says. Each entry lists more, with sources.

Widely repeated claimWhat the record saysEntry
"Russian hackers attacked a German steel mill."A 2015 Bloomberg report said "now being attributed to Russian hackers" and named no attributing body. No government attribution was found.German Steel Mill
"Norsk Hydro expecting $69m hit from cyber attack."Hydro never gave a dollar figure. The $69 million was a trade publication's conversion of a first-quarter estimate plus a second-quarter forecast. Hydro kept counting: around NOK 650 to 750 million for 2019, and around NOK 800 million in total.Norsk Hydro
"The shutdown cost Toyota about $375 million."Bloomberg's own "rough calculation of its sales and output data," not a Toyota figure and not a disclosed cost.Toyota
"The 2022 attack cost $100 million to $150 million."Undisclosed. The parent named the incident in its Q1 2022 slides with no figure, and we cannot find where the range came from.Bridgestone
"Ingersoll Rand was hit by Stormous ransomware."Ingersoll Rand names no actor and no malware. A Stormous listing is a claim, dated a month before detection by one tracker, and never linked to the incident.Ingersoll Rand
"Nucor had to shut down OT."Both filings describe IT systems only. Nucor described the halt as proactive and made "in an abundance of caution"; "had to" turns a choice into a compulsion.Nucor
"It started with a vishing call to the JLR IT helpdesk."No identifiable source. Never stated by JLR, the government, Parliament or any regulator. The minister who described helpdesk tricks added: "I am not saying that that is what happened in this case." BlastWave published this as fact and withdrew it on 1 September 2026.Jaguar Land Rover
"The Clorox cyberattack cost $356 million."$356M is in no Clorox filing. The filed net sales lines give a $354M quarterly sales decline, which is not a cost. The disclosed incremental cost was $49M through December 2023 and $57M through March 2024.Clorox
"Chip company loses $250m after ransomware hits supply chain."Applied Materials built a $250M estimate into its next-quarter outlook. It reported no loss, and its next results release does not mention the estimate.MKS Instruments
"West Pharmaceutical was hit by ransomware."West's filings since the incident never use the word. West said data was exfiltrated and systems encrypted; "ransomware" is the press's inference, and no group is on the record claiming it.West Pharmaceutical
"Iran attacked Stryker."Handala claimed it. The Justice Department says the MOIS used the Handala domain to claim credit for an attack on an unnamed firm. That is about the claim, not the deed.Stryker
"Johnson Controls' manufacturing shut down."The filings say "disruption to parts of the Company's business operations." "Manufacturing and everything is down" is one unnamed customer's secondhand account in press.Johnson Controls

BlastWave analysis: why the plants stopped

Analysis, not a disclosed fact

Across the twelve entries, the public record rarely places an intruder on a plant control system; the 2014 steelworks is the exception. What stopped production elsewhere was the plants' dependence on business systems, such as order processing, shipping and supplier links, and the companies' own decisions to isolate those systems. That is BlastWave's reading of the record, not a finding of any investigator. It is also why the entries' recommendations focus on what a plant needs from the business network to keep running, and on removing the paths an intruder uses to reach it.

Frequently asked questions

What are the major cyberattacks on manufacturers?

The Manufacturing edition documents twelve: an unnamed German steelworks (disclosed 2014), Norsk Hydro (2019), Toyota's plant stoppage after a ransomware attack on supplier Kojima Industries (2022), Bridgestone Americas (2022 and 2025), MKS Instruments (2023), Ingersoll Rand (2023), Clorox (2023), Johnson Controls (2023), Nucor (2025), Jaguar Land Rover (2025), Stryker (2026) and West Pharmaceutical (2026).

Have hackers ever caused physical damage at a factory?

Germany's Federal Office for Information Security (BSI) reported in December 2014 that attackers reached an unnamed steelworks' production networks and that failing control components left a blast furnace unable to be shut down in a controlled manner, causing massive damage to the plant. The BSI named no company, date, attacker or malware. No other entry in this edition records physical damage to plant.

Why do factories stop production after a cyberattack on IT systems?

In this edition the stoppages mostly follow from dependence on business systems and from the companies' own containment. Norsk Hydro isolated its plants in 2019. Bridgestone Americas disconnected plants in 2022. Clorox moved order processing to manual procedures at a reduced rate in 2023. Nucor halted production "in an abundance of caution" in 2025. Jaguar Land Rover shut down its global systems in 2025.

How much did the biggest manufacturing cyberattacks cost?

Norsk Hydro estimates its total cost at around NOK 800 million. Clorox disclosed $49 million of incremental costs through December 2023; the widely quoted $356 million is a sales decline in no Clorox filing. MKS Instruments disclosed $15 million, net of recoveries, while the quoted $200 million was expected lost revenue. Jaguar Land Rover reported quarterly cyber costs and, in the releases read for its entry, no total.

Was Toyota hacked in 2022?

No record says a Toyota system was hacked. On 1 March 2022 Toyota stopped all 28 lines at its 14 plants in Japan for one day after a system failure at parts supplier Kojima Industries, which by its own account had been hit by ransomware through a subsidiary's vulnerable remote connection device. The attacker, malware family and cost are undisclosed.

How does Hackopedia verify a manufacturing incident?

Every figure, date and quotation in an entry traces to a company filing, a court record, a government or regulator document, the company's own dated statements, a named researcher's published work, or a dated publication named as such, and each was checked against its source by hand. Claims resting on press, trackers or unnamed sources are marked as reported, and errors in Hackopedia's own first volume are corrected on the page.

Other editions

Cite this page

BlastWave. “Cyberattacks on Manufacturers: The Verified Record (2014 to 2026).” Hackopedia, Volume 2, Manufacturing edition. Last verified 28 September 2026. https://hackopedia.blastwave.com/manufacturing/

Revision history

DateChange
5 Oct 2026Manufacturing edition published with twelve entries. FILE numbers run across all of Hackopedia Volume 2, not by edition.

How Hackopedia verifies an entry

Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry