Manufacturers are facing an increasingly hostile cyber threat landscape, with ransomware, stolen credentials and vulnerability exploitation continuing to drive the majority of breaches across the sector, according to Verizon’s latest Data Breach Investigations Report (DBIR).
The 2026 DBIR analysed more than 31,000 real-world security incidents globally, including over 22,000 confirmed data breaches. Within manufacturing specifically, Verizon recorded 3,627 incidents, of which 2,713 involved confirmed data disclosure.
According to the report, System Intrusion, Social Engineering and Basic Web Application Attacks accounted for 91% of manufacturing breaches analysed.
Ransomware continues to dominate the threat picture for industrial businesses. Verizon found malware was present in 75% of manufacturing breaches, while ransomware specifically featured in 61% of cases.
The report also highlighted the growing role of credential compromise and vulnerability exploitation in attacks targeting manufacturers. Hacking actions were involved in 71% of breaches, with the leading tactics identified as use of stolen credentials and exploitation of vulnerabilities, both appearing in 41% of incidents.
Verizon said the wider threat landscape is evolving rapidly as attackers increasingly automate and scale operations using artificial intelligence.
“Exploitation of vulnerabilities has now emerged as the most common way attackers gain initial access into an organisation’s environment, which underlines the ongoing importance of getting the basics right,” Verizon’s DBIR team wrote in the report introduction.
For manufacturers operating connected production environments, industrial control systems and increasingly digitised supply chains, the findings reinforce growing concerns around operational resilience and cybersecurity preparedness.
The report found external actors were responsible for 95% of manufacturing breaches, while financial motives accounted for 87% of attacks. Espionage-related activity was also notable, featuring in 15% of breaches analysed.
Third-party exposure is becoming another major area of concern for manufacturers. Verizon reported third-party involvement in 61% of manufacturing breaches, underlining the growing cyber risks associated with complex supplier ecosystems, cloud services and software platforms.
Human behaviour also remains a significant vulnerability. The report found a human element was involved in 56% of manufacturing breaches, while Social Engineering attacks accounted for 16% overall. Within that category, phishing represented 77% of social attacks and pretexting accounted for 18%.
Verizon noted that social engineering techniques are becoming increasingly sophisticated, particularly through voice calls and mobile-centric attack methods.
“Training IT help desks and customer support agents to not be helpful and supportive in cases when a threat actor is trying to manipulate them is not as simple as ‘check if the email is external’,” the report stated.
The report also warned that manufacturers’ growing adoption of AI tools may create additional exposure. Verizon found 45% of employees are now regular users of AI tools on corporate devices, while “shadow AI” — the unauthorised use of external generative AI platforms — is becoming an increasingly common insider-related risk.
Source code, images and structured data were among the most common information types uploaded to external AI systems, raising concerns around intellectual property leakage and sensitive engineering data.
The report concluded that despite the evolving sophistication of attacks, cybersecurity fundamentals remain critical.
“Organisations that stay grounded in strong cybersecurity basics — clear visibility into assets and third parties, disciplined patch management, and well-practised response plans along with a culture that supports and enables secure behaviour — are better positioned to handle today’s realities and whatever comes next,” Verizon said.
The full Verizon 2026 Data Breach Investigations Report is available here.
For more articles like this, visit our Digitalisation channel
