For years, manufacturers assumed cyber was a bank's problem, or a retailer's. That assumption is expensive now. Ransomware crews specifically hunt operations where downtime is intolerable and the pressure to pay is immediate — and few operations fit that profile better than a manufacturing or distribution plant running to a schedule.
Why manufacturers pay
The math is brutal and the attackers know it. A halted line doesn't just lose today's output; it misses shipments, triggers penalties, and idles a workforce that still has to be paid. Every hour of leverage sits on the attacker's side of the table. That's why manufacturing has moved to the top of the ransomware target list — not because plants are careless, but because they can't afford to wait.
IT is not where the risk lives
Most cyber attention goes to email, servers, and customer data — the IT side. On a plant floor, the exposure is operational technology (OT): the PLCs, SCADA systems, and industrial controls that actually run the line, many of them a decade old and never designed to be networked. When ERP and OT connect for efficiency, they also connect for the attacker. The breach that matters isn't the one that steals data — it's the one that stops production.
The property policy gap
Here's the trap: a cyber event that halts your line feels like a property loss, but your property policy almost certainly excludes it. No fire, no wind, no physical peril — no coverage. The income you lose to a ransomware-driven shutdown falls squarely outside a standard property or BI form and squarely inside a gap most manufacturers don't know they have.
What cyber coverage actually has to do
- Extortion and response — negotiation, ransom (where lawful), and incident response the moment the line goes dark.
- Cyber business interruption — the lost income a property policy won't touch.
- System restoration — rebuilding OT and IT environments, not just wiping laptops.
- Contingent cyber BI — downtime caused by an attack on a technology vendor or supplier you rely on.
The plant floor became a target the moment it got connected. The coverage has to be built for the downtime, not just the data.