Manufacturing Sector Sees Increased Backup Usage, but Records Lowest Recovery Rates among Industries

More than two-thirds (68%) of ransomware attacks resulted in successful data encryption, marking the highest encryption rate in the sector over the past three years, according to the latest survey report from Sophos.

Despite the alarming encryption rate, the report also revealed a positive trend in the sector’s use of backups for data recovery. This year, 73% of surveyed manufacturing organizations reported using backups, compared to 58% in the previous year. However, the sector still struggles with data recovery, recording one of the lowest recovery rates among industries.

“Using backups as a primary recovery mechanism is encouraging, as it facilitates faster recovery. Paying a ransom, on the other hand, doubles the costs of recovery,” commented John Shier, field CTO at Sophos. “With 77% of manufacturing organizations experiencing lost revenue after a ransomware attack, it is crucial to prioritize early detection and response to avoid this additional cost burden.”

Despite the increased use of backups, manufacturing and production companies reported longer recovery times compared to the previous year. In 2022, 67% of organizations recovered within a week, while 33% took more than a week. However, the latest survey showed that only 55% of manufacturing organizations managed to recover within a week.

“Longer recovery times in manufacturing are a cause for concern. Sophos’ Active Adversary reports consistently highlight the manufacturing sector as one that requires significant assistance in recovering from attacks,” stated Shier. The extended recovery periods not only impact IT teams but also hinder their ability to work on other crucial projects, according to the survey results.

To combat ransomware attacks, Sophos experts recommend the following best practices for manufacturing organizations and other sectors:

• Strengthen defensive measures with advanced security tools that protect against common attack vectors, such as endpoint protection with strong anti-exploit capabilities and Zero Trust Network Access (ZTNA) to prevent credential abuse.
• Implement adaptive technologies that automatically respond to attacks, disrupting adversaries and buying time for defenders to respond effectively.
• Ensure round-the-clock threat detection, investigation, and response capabilities, either through an in-house team or with the assistance of a specialist Managed Detection and Response (MDR) provider.
• Optimize attack preparation by regularly backing up data, practicing data recovery from backups, and maintaining an up-to-date incident response plan.
• Maintain good security hygiene by promptly applying patches and regularly reviewing security tool configurations.