Ransomware Attacks on Manufacturing Surge to Five-Year High in 2023 Ransomware attacks against manufacturing and production organizations reached a five-year peak in 2023, with two-thirds of companies in the sector reporting incidents, according to a Sophos report. Of those targeted, over 60% paid a ransom nearly double the 34% rate in 2022 making manufacturing one of the top-paying industries alongside energy and oil and gas. Sophos Field CTO John Shier noted that manufacturing firms face higher success rates for attacks due to perceived vulnerabilities, encouraging threat actors to target the sector. The average ransom payment surged 88% to nearly $2.4 million, with 60% of initial demands exceeding $1 million. Recovery costs also climbed, averaging $1.7 million a 55% increase from 2022. The impact of such attacks was demonstrated by Clorox, which suffered severe operational disruptions and $49 million in recovery expenses following an August 2023 cyberattack. The report, based on a survey of 585 IT and cybersecurity leaders across the Americas, EMEA, and Asia-Pacific, underscores the growing financial and operational risks ransomware poses to the manufacturing sector.

In August 2023, Clorox fell victim to a social engineering attack executed by the Scattered Spider group. Attackers impersonated locked-out employees via repeated calls to Cognizant’s outsourced service desk, exploiting weak verification processes to reset passwords and multi-factor authentication (MFA). This granted them domain-admin access, enabling lateral movement across Clorox’s systems. The breach led to operational paralysis, including offline production systems, paused manufacturing, manual order processing, and shipment delays, causing $380 million in damages—comprising $49 million in remediation costs and hundreds of millions in business-interruption losses. The incident underscored vulnerabilities in third-party help desk security, particularly outsourced high-privilege access, and highlighted the cascading impact of a single compromised identity on enterprise-wide operations. Clorox’s lawsuit alleged contractual violations by Cognizant, citing failure to enforce mandatory authentication procedures before credential resets.

The Clorox company filed a lawsuit against Cognizant, a third-party technology provider, for a 2023 ransomware attack that cost the bleach maker $380 million. The hack, carried out by the Scattered Spider ransomware group, caused widespread disruption to Clorox's operations and devastated its IT infrastructure. The lawsuit alleges that Cognizant employees handed over their login credentials to the hackers, leading to the breach. The attack resulted in significant supply chain disruptions and restoration costs.