A factory cyberattack rarely begins with a dramatic warning on every screen. It may start with a compromised Microsoft 365 account, a supplier’s remote connection or one unpatched computer in the office. By the time files are encrypted or access is blocked, the effect can reach the shop floor: production plans disappear, labels cannot print, stock movements stop and promised delivery dates become difficult to meet.
For a manufacturer, the priority is clear. Keep people safe, protect machinery and restore controlled production as quickly as possible. That takes more than antivirus software and a backup drive in a cupboard. It requires a clear view of the systems that keep work moving, sensible separation between them, and rehearsed decisions for the first few hours of an incident.
Why a factory cyberattack causes wider disruption
Most factories rely on a chain of connected technology. ERP or MRP systems create works orders and purchasing data. CAD and CAM files feed engineering and machining. Warehouse scanners update stock. Machinery-connected PCs run specialist software, while office systems handle communication, finance and customer information.
An attack against any point in that chain can slow or stop the rest. If the MRP system is unavailable, production may still be physically possible, but teams can soon lose confidence in which job should run next, what material is available and which revision of a drawing is correct. Running on paper may buy time, but it is not a recovery plan for long.
Ransomware is the threat many leaders think of first. It remains a serious concern because criminals can encrypt data and steal it before demanding payment. However, a stolen password, fraudulent supplier email or unauthorised remote access can be just as damaging. The immediate cost is downtime. The longer-term cost may include missed deliveries, damaged customer confidence, lost intellectual property and difficult questions from insurers or supply-chain partners.
What to do in the first hours of a factory cyberattack
The first objective is containment, not diagnosis. If a computer displays a ransom note, behaves unusually or begins changing files unexpectedly, disconnect it from the network. Do not switch it off unless advised by your IT team or incident specialist, as useful evidence may be lost. Preventing further spread is usually more valuable than getting one machine working again quickly.
Your nominated incident lead should then contact the people responsible for IT support, operations and senior decision-making. Production should not be left to guess whether a system is safe to use. Give supervisors a simple instruction: which systems are unavailable, what manual process is authorised, and who can approve exceptions.
Avoid rushing to restore files before understanding the scope. Restoring an infected server into a still-compromised network simply creates a second outage. A good response checks whether attacker access has been removed, changes affected credentials, preserves logs where possible and confirms that backups are clean before recovery begins.
For many businesses, external suppliers add another complication. Your ERP provider, machine integrator, telecoms provider and IT support company may each own part of the answer. Keep an up-to-date contact list and agree in advance who has authority to approve emergency access or configuration changes. During an incident is a poor time to discover that the only person with a password is on holiday.
Map the systems that affect production
You cannot protect every device in the same way, but you do need to know what you have and what would happen if it failed. Start with the systems that directly affect output: ERP and MRP, file storage for drawings, CAD and CAM applications, warehouse technology, label printers, production servers, internet connections and machinery-connected computers.
For each system, record its owner, supplier, location, operating system, backup method, dependencies and acceptable downtime. Include shared workstations and older devices. They are often omitted from normal IT records because they are not assigned to one person, yet they may be essential to a cutting cell or test process.
This exercise should also identify the awkward cases. A Windows 7 machine running a piece of specialist equipment may not be replaceable quickly. That does not mean it must be exposed to the wider network. It means the business needs a documented risk decision and compensating controls, such as separating the device, tightly limiting access and removing unnecessary internet connectivity.
Separate office IT from factory-floor equipment
Network segregation is one of the most effective ways to limit disruption. In plain terms, it means dividing the network into controlled sections so that a problem in one area cannot freely reach another.
A sensible design commonly separates office users, servers, guest Wi-Fi, warehouse devices, production equipment and remote supplier connections. The precise arrangement depends on the equipment and workflow. A small workshop does not need enterprise complexity for its own sake. It does need rules that allow only the required communication between systems.
For example, an engineer may need access to a production file share from an office PC, while a CNC controller may only need access to one approved application or folder. Those are different requirements. Giving every device broad access because it is convenient makes a cyber incident easier to spread.
Factory Wi-Fi deserves the same care. Handheld scanners, tablets and visitor devices should not automatically sit on the same network as critical production systems. Reliable coverage matters, but so does controlling what can connect and where it can go once connected.
Secure legacy equipment without stopping the line
Replacing every old industrial PC is rarely practical. Some systems were supplied with a machine, rely on obsolete software or need a specialist engineer to validate changes. A blanket instruction to update everything can create its own downtime.
The better approach is risk-based. First, establish whether the device genuinely needs network or internet access. If it does not, remove it. If it needs access to a specific server, restrict communication to that destination. Use strong, individual administrator accounts where supported, remove unused software and block casual USB use where this will not disrupt the process.
Patch modern, supported systems through a planned process. Test changes where machinery software is sensitive, and schedule work around production requirements. For unsupported systems, reduce exposure rather than pretending they are fully secure. Network isolation, controlled access, secure backups and a replacement plan are often the realistic route.
Remote supplier access needs particular attention. It should be approved, time-limited, protected by multi-factor authentication and logged. Permanent remote access is convenient until it becomes someone else’s route into your factory.
Backups must restore the systems you actually need
A backup that has never been restored is an assumption, not a recovery capability. Manufacturing businesses should back up more than general office documents. Check that the scope includes ERP and MRP databases, CAD and CAM data, configuration files, production application servers and, where possible, the settings needed to rebuild critical devices.
Keep copies protected from normal network access so ransomware cannot simply encrypt the backups too. The right design varies, but it should include separate, protected copies and a defined retention period. Encryption is also necessary where backups contain customer data, employee information or commercially sensitive designs.
Regular restore testing matters more than an impressive-looking backup report. Test a realistic scenario: can you restore a critical server, access the latest production data and allow the right users to work? Measure how long it takes. If restoring the MRP system takes two days but production can only tolerate four hours without it, the gap needs a business decision, not a technical excuse.
Make people part of the control
Many attacks start with a convincing email, a reused password or an unexpected login prompt. Multi-factor authentication significantly reduces the value of a stolen password and should protect email, remote access, administrator accounts and cloud services wherever available.
Training should be short, relevant and repeated. A purchasing team needs to recognise a changed bank-details request. Engineers need to know what to do with an unexpected file-sharing invitation. Production staff need a clear route to report a suspicious screen without worrying that they have caused trouble.
Cyber Essentials can provide a useful baseline for many manufacturers, particularly where customers ask for evidence of security controls. It is not a substitute for managing legacy equipment, production dependencies or recovery planning. Treat certification as part of a wider security programme, not the finish line.
Turn response planning into operational confidence
A written incident plan should answer practical questions: who can isolate systems, who communicates with customers, where key contacts are stored, how production priorities are decided, and when specialist support is called. Keep a printed copy available. An online plan is less helpful when your email and file storage are unavailable.
Run a short tabletop exercise with operations, finance and IT. Use a clearly hypothetical scenario, such as the MRP server becoming unavailable at 7am on a busy Monday. Work through what happens in the first hour, first day and first week. The aim is not to catch people out. It is to expose unclear responsibilities before they become expensive.
If you are unsure whether your current arrangements would contain a factory cyberattack, start with a review of critical systems, network separation, remote access and backup recovery. Syn-Star can help manufacturing businesses turn that review into a practical improvement plan that protects production without making day-to-day work harder.
