Services production depends on
A PLC can keep executing its program while the plant's business workflow stops. Without orders, recipes or work instructions from ERP, starting new production may be impossible. Labelling and shipping may also depend on that system.
Some plants run SCADA, HMI and historian servers on virtualization infrastructure. Losing that infrastructure can take away the operator's view of the process. Continued local PLC control does not establish that operators can still monitor production.
In one Akira case described by Dragos, attackers accessed the virtualization manager directly and created a new server. That layer can be a common point of failure for the OT servers it hosts. Which servers would be lost together depends on the plant's architecture.
The operator's shutdown decision
When ransomware is found on the corporate network, an operator may stop production to keep it from spreading into OT. The pharmaceutical manufacturer in May is one of the report's precautionary shutdown examples.
In June 2026, milling also stopped at two of a sugar producer's three mills. Dragos assesses with low confidence that the incident mainly affected corporate IT and says it saw no evidence of the actor reaching OT or directly manipulating it.
A production outage alone therefore cannot establish that a PLC was compromised. An investigation needs to identify the failed services and the operator's decisions separately.
Questions to answer before an outage
A plant's dependency map needs concrete answers to these questions:
| What to check | What the answer should identify |
|---|---|
| What stops if ERP, authentication or the historian is lost? | The affected production, labelling and shipping steps. |
| Which servers host SCADA and HMI? | Systems that would be lost with the same virtualization layer. |
| Can the plant operate without the corporate network? | Work that can continue without IT, and for how long. |
| Who decides to stop production? | A designated decision-maker and shutdown criteria. |
| Can OT configurations and virtual servers be restored? | Offline backups and tested recovery procedures. |
This work considers the IT/OT boundary alongside the recovery plan. Defensible architecture, network visibility and incident response in the SANS five critical controls address these needs.
Dragos assesses with high confidence that these IT intrusions can lead to operational downtime, loss of view and safety risk. Identifying the dependencies that could cause this at a particular plant requires its own inventory and operating plan.
Scope of the report
Dragos identified 1,140 industrial ransomware incidents in Q2 2026 using publicly disclosed victim data and ransomware groups' leak sites. That was a 12% increase over the previous quarter; 747 incidents (65%) were in manufacturing. Construction, equipment, and food and beverage were prominent manufacturing subsectors. The most active groups were Qilin, Akira and The Gentlemen.
The report observed no ransomware operator reaching stage two of the ICS Cyber Kill Chain, which involves manipulating the physical process, during that quarter. This is the observation boundary of the cases Dragos examined.
Source: Dragos Industrial Ransomware Analysis, Q2 2026 · 10 August 2026 ↗