Published analysis records 1,929 documented attacks against industrial sectors in 2025, with manufacturing and construction each accounting for around 21% of the total, and manufacturing described as absorbing a 56% surge in global ransomware activity. Average ransom payments for manufacturing organisations reached approximately $1 million, with recovery costs excluding ransom averaging $1.3 million.
Separately, sector research reports that manufacturers are blocking a greater proportion of ransomware attempts, while adversaries increasingly pivot to data theft.
Those Two Findings Are The Same Finding
Better encryption prevention does not reduce attacker revenue; it changes what the attacker sells. If the files cannot be locked, the leverage becomes publication — and exfiltration is easier to accomplish and harder to prevent than encryption, because it resembles normal traffic.
The defensive investment worked exactly as designed and moved the problem. This desk filed the same dynamic at 26-0512: the industry measures its progress against the technique it defeated rather than against the outcome.
And It Is Worse For Manufacturers Specifically
A manufacturer’s most valuable data is not personal information. It is process parameters, tooling designs, supplier terms and product roadmaps — as at 26-0622.
That data has no breach-notification regime attached, because it belongs to no individual. A manufacturer can lose the accumulated engineering knowledge that constitutes its competitive position and have no disclosure obligation whatsoever. On every register in this corpus, that incident does not exist.
On The Percentages
A 56% share and a 21% share appear in the same paragraph above because they come from different studies measuring different populations — one global ransomware activity, one documented industrial attacks. They are not reconcilable and should not be added, compared or averaged.
Graded medium. The direction across these studies is consistent; the magnitudes are not comparable, and this desk’s position on aggregating vendor telemetry is set out at 26-0513.
Built on published sector research, listed below. Figures come from separate studies with different sampling frames and definitions and are not directly comparable. Corrections: corrections@forensicpost.com.