Cyber Security for Manufacturing: Lessons from Recent High-Profile Attacks
As Cyber Security Awareness Month draws to a close, cyber attacks continue to make the headlines, and not the good headlines. Unfortunately, many high-profile organisations have suffered cyber attacks in recent times. The recent ASOS cyber incident is an example of how cyber incidents can quickly become public and damage trust – with their stock price initially dropping by 13% after the push notification was sent out. You can read more on this attack here.
Short on time? Head to the bottom of the article for your next steps checklist.
Many businesses, perhaps naturally, think “this won’t happen to us”. This is, unfortunately, incorrect. Cyber criminals will, and have proven time and time again, that they don’t care what size your business is. If there’s a vulnerability, they will find it and attempt to work their way in. Despite the recent high-profile cases, it is typically the smaller organisations (ones who don’t prioritise cyber security) that are impacted the most.
In August of this year, The Guardian reported that 30% of UK manufacturers experienced a cyber attack on their supply chain within the last year. Nearly 1 in every 3 manufacturing businesses was impacted – scary numbers! It’s therefore likely, if you work in the manufacturing sector in the UK, either your business or someone you know was likely impacted.
In this article, we look at what manufacturers can learn from recent cyber incidents and the practical steps that can help reduce risk.
Why Cyber Attacks Are Dominating Headlines
Cyber attacks in the modern day are becoming more visible, it’s almost like cyber criminals are competing with each other to see who can get the best ‘scalp’.
There is a greater reliance on technology now, particularly within the manufacturing sector and it is now an expectation from customers that their data is protected at all times.
What the recent times has shown us is that cyber attacks are no longer just an IT issue – they impact operations, reputations and customer confidence.
Reputation Can Be Damaged Overnight
Customers need confidence in suppliers and due to the aforementioned high-profile events, cyber security will be edging its way closer to the top of the list for customers when choosing which manufacturer to be their suppliers.
Customers will not be interested in the technical details; they’ll focus on whether their data has been breached and, subsequently, find a supplier who can keep their data safe.
The recent ASOS example and subsequent share price drop is the perfect example. In a split second, all it took was one push notification for people to demonstrate that they had lost confidence in ASOS.
Why does this matter to manufacturers?
Just 10 minutes of downtime can have such a significant impact on manufacturers. It’s not just within the factory that is impacted, it’s the domino effect of the customer, then their customer and so on, who are also impacted.
This leads us nicely onto the next section…
Downtime Is Often More Costly Than Data Loss
Neither downtime nor data loss is anything any business will ever want to experience. Many assume that data loss is the more costly of the two. However, downtime, particularly for manufacturers, will have a serious impact on your operations. The knock-on effect can be never-ending as supplier waits on supplier after supplier and the customer is left at the other end.
In 2025, The Co-op suffered a cyber-attack with the final cost to the business being around £206,000,000 in lost sales. The impact was felt long after the attack and financial loss as the company began to “rebuild and become stronger to meet the challenges and opportunities that lie ahead”. The Co-op reported a £75,000,000 loss in six months.
For manufacturers, the consequences are even more severe. A temporary outage doesn’t just impact sales, it can affect production schedules, delay shipments (both incoming and outgoing), disrupt supplier relationships (which has a significant impact on trust) and create a backlog that takes weeks to recover from. In sectors where delivery times and reliability are critical, even a short period of downtime can have lasting effects on customer confidence and future business opportunities.
A useful question to ask yourself is: What would a day of lost production cost our business?
For many organisations, the answer is likely to be significantly higher than the cost of implementing preventative cyber security measures in the first place.
Human Error Still Plays a Major Role
Most cyber attacks don’t start with a sophisticated hack. Cyber criminals will target people because they’re easier to bypass than technology is. These criminals will know that businesses spend thousands on cyber security software, which we know to be a worthy investment, as this acts as a deterrent to cyber criminals. Instead, they target employees who are under-trained on the cyber front.
Let’s run through a series of manufacturing-focused cyber-attack examples:
Phishing attacks
An email comes in appearing to be from a supplier, such as a fake delivery notification, a purchase order request or an invoice reminder. The email will prompt the recipient to engage in one way or another. For larger manufacturing companies who receive a large volume of external emails every day, it is easier for malicious messages to blend in.
Key takeaway: Would you trust your employees to spot a fake invoice if it arrived during month-end processing?
Social Engineering
This is more advanced than phishing attacks as it moves beyond email and becomes impersonation. Most businesspeople are on LinkedIn (LinkedIn had 45,000,000 users as of 2025). This is where hackers will gather information from and pretend to be trusted partners of your manufacturing business. Even as of earlier this year, it was reported that hackers had now moved onto audio deepfakes. More information on that here.
Fake Supplier Requests
This one is particularly relevant within the manufacturing sector as these businesses often work with numerous different suppliers. Typically, these emails will also often have some form of urgency attached to them, e.g. a time deadline attached.
With advanced tools such as Photoshop and even AI, it is really simple and quick to create realistic looking supplier request forms that some employees may fall for. Remember, 62% of all successful phishing attacks involve human error at some point, it’s easy to see why cyber criminals keep returning here to target them.
This is why we always recommend uSecure to our manufacturing clients. uSecure helps organisations reduce human cyber risk through employee training, phishing simulations and ongoing cyber security awareness education.
Regular training helps keep cyber security front of mind, ensuring employees can recognise suspicious emails, verify unusual requests and respond appropriately when something doesn’t look right.
Over time, this builds a stronger security culture and reduces the likelihood of successful phishing, credential theft and social engineering attacks.
The lesson from many recent cyber attacks is clear: technology plays a vital role, but cyber security remains a people issue as much as a technical one.
We are currently offering a FREE 4-week trial of uSecure, giving organisations the opportunity to experience the benefits of the platform first-hand and gain valuable insight into their current level of cyber awareness.
Drop us a message here to start your free trial.
Why Cyber Security for Manufacturing Companies is a Requirement
Many recent cyber attacks have highlighted a common challenge facing the manufacturing sector: legacy technology.
According to research from Made Smarter: 74% of UK manufacturing and engineering firms still rely on legacy systems. Older systems were designed when cyber criminals were:
a) not as common, and
b) not as advanced as they are today.
From our experience, some systems even no longer receive security updates. Systems like this are a gold mine for attackers.
Of course, replacing these systems isn’t always straightforward as machinery may still work perfectly or upgrading may require production downtime (the consequences of which we have already touched upon in this article). There may also be financial pressure or integration challenges associated with newer platforms.
We’re on a mission to educate as many Scottish and UK businesses as possible on the importance of cyber security. This is particularly aimed at boardroom level, where the outlook has for so long been focused on making business-sense decisions, which typically doesn’t incorporate cyber security.
Now, it is imperative that boardrooms start actively discussing their approach to cyber security. Even more so in Manufacturing.
From a business perspective, it often makes sense to stick with an old yet working system. From a cyber security perspective, it can create additional risk.
Manufacturers have an effective solution available to them in CyberGuard. This layered security solution provides vulnerability management, security monitoring and proactive threat detection. Organisations can strengthen protection around legacy environments while planning longer-term modernisation projects.
The lesson from many recent cyber attacks is clear: systems that were built for productivity twenty years ago may not be equipped to deal with today’s cyber threats.
Where Does Cyber Essentials Fit?
We’ve touched on human error, legacy systems, MFA, monitoring and security awareness.
Many of the lessons highlighted throughout this article are directly addressed by the controls assessed as part of Cyber Essentials.
Cyber Essentials is a UK Government-backed certification scheme designed to help organisations protect themselves against some of the most common cyber threats. Rather than focusing on advanced cyber security measures, it provides a practical framework built around the fundamental controls every organisation should have in place.
For example, Cyber Essentials places a strong emphasis on areas such as secure configuration, access control, patch management, malware protection and multi-factor authentication. These are all measures that directly address many of the lessons highlighted throughout this article.
For manufacturers, Cyber Essentials provides reassurance to customers, suppliers and stakeholders that cyber security is being taken seriously. As supply chains become increasingly interconnected, organisations are placing greater scrutiny on the cyber security practices of the businesses they work with.
Cyber Essentials should not be viewed as a replacement for wider cyber security measures such as employee awareness training, threat monitoring and incident response planning. However, it does provide a strong foundation for reducing common risks and improving overall cyber resilience.
For many manufacturers, Cyber Essentials represents one of the most practical and cost-effective starting points for strengthening cyber security and demonstrating a commitment to best practice.
The purpose of reviewing high-profile cyber attacks isn’t to criticise those involved. Instead it’s to learn from them.
Every attack discussed during this article provides valuable lessons for all organisations. But given the increased number of attacks on manufacturing organisations – it’s ever more important, if you work within this sector, to focus on this as the underlying themes remain remarkably similar.
Human error remains one of the most commonly exploited weaknesses, and legacy systems continue to create security challenges. In manufacturing, downtime can be more damaging than data loss due to the associated knock-on effects.
We know, from our experience of supporting UK businesses with cyber security, that early detection significantly reduces impact. This is why we are such big advocates of Huntress and CyberGuard.
Whilst Cyber Essentials demonstrates an organisation's willingness to prioritise cyber security, it also helps build trust with customers, suppliers and investors. So much so, that we believe it is now a ‘no-brainer’.
So, what should manufacturers do next?
Whilst Cyber Security Awareness Month (October) provided an excellent reminder to review your current cyber defences – this is something you should be doing all year round.
Next Steps Checklist
Assess whether MFA is enabled across critical systems.
Review employee cyber awareness levels. Solution = uSecure
Identify unsupported or high-risk legacy systems.
Evaluate your monitoring and detection capabilities. Solutions
= Huntress or CyberGuard
Consider whether Cyber Essentials could strengthen your approach.
The good news is that improving cyber security doesn’t require everything to happen at once. It is a small, gradual process towards improving your current posture – all of which reduce your risk.
Proper, solidified cyber resilience is built up over time through practical, incremental changes.
Want to learn more about how KubeNet supports modern manufacturing businesses?
Read on here.
Comments