Manufacturing leads the target list because it can least afford to stop

Event dated 12 May 2026 · Published 2 September 2026 · 3 sources

Reporting in May 2026 put manufacturing at the top of the global target list, with ransomware dominating the losses, alongside an acknowledged attack on Foxconn's North American factories on 12 May after a group claimed to have taken 8 terabytes of data. The concentration is not explained by wealth or by weak security. It follows from one property: a stopped production line costs a known amount per hour, starting immediately. That makes the pressure to resolve quickly calculable by both sides — which is exactly what an extortion business needs to price its demand.

A hospital that loses its records has a crisis with an uncertain cost. A retailer that loses its customer list has a problem measured in reputation and regulatory exposure, both of which take months to become numbers.

A factory that stops knows what it is losing before lunchtime. Output per shift is a figure the operations team quotes from memory, and every hour of stoppage subtracts from it in a way that appears on this month's accounts rather than next year's.

Certainty is what makes it a market

Extortion requires the victim to compare two numbers: the cost of the demand and the cost of refusing. Where the second number is vague, the comparison is a judgement and the answer is frequently no. Where it is precise and accumulating hourly, the comparison becomes arithmetic.

That is uncomfortable to state plainly, and it is the mechanism. Sectors get targeted in proportion to how quickly and how confidently they can calculate the cost of being down, because that calculation is the thing being sold against.

The same property blocks the defence

The reason a plant cannot easily be patched is that patching means stopping, and stopping is the expensive thing. So the constraint that makes the sector attractive to attack is the same constraint that prevents the ordinary response to it. That is not a coincidence to be worked around; it is the shape of the problem.

Which means the advice that works elsewhere — patch promptly, restart often, deploy the agent everywhere — arrives at a plant as a request to do the one thing the business exists to avoid.

What actually reduces the exposure

Separation that survives a bad day on the corporate network. If reaching a production controller requires passing through a path that simply does not exist, the compromise of an office laptop stops being the first step of a plant outage. That is a design decision taken once, and it does not require the line to stop to keep working.

The second is knowing, before anybody asks, how long production can run without the systems that schedule and record it. Plants that have rehearsed operating on paper for two days negotiate from a different position than plants discovering the answer while a countdown runs.