Sophos, a global leader of innovative security solutions for defeating cyberattacks, today announced new findings from the Sophos State of Ransomware in Manufacturing and Production 2025 report.

Sophos

The study reveals that manufacturers are stopping more ransomware attacks before data can be encrypted; however, adversaries are increasingly stealing data and using extortion-only tactics to maintain pressure. 

As a result, more than half of manufacturing organizations impacted by encryption paid the ransom despite progress in defensive measures. The report is based on an independent survey of 332 manufacturing organizations that were hit by ransomware in the last year.

The Sophos State of Ransomware in Manufacturing and Production report found:

●      Encryption rates are falling, but adversaries are shifting tactics: 40% of attacks on manufacturers resulted in data encryption, the lowest level in five years and down from 74% last year. However, extortion only attacks surged to 10% from just 3% in 2024 as attackers increase reliance on data theft for leverage.

●      Data theft remains a significant concern: 39% of manufacturers that experienced encryption also had data stolen, one of the highest rates across all surveyed sectors.

●      More organizations are stopping attacks before encryption: 50% of manufacturing organizations stopped the attack before data could be encrypted, more than double last year’s 24%.

●      Expertise shortfalls and inadequate protection fuel attacks: Lack of expertise was cited by 42.5% of organizations. Unknown security gaps were cited by 41.6%, and a lack of protection by 41%. Respondents identified an average of three internal factors that contributed to the attack.

●      More than half of manufacturers with encrypted data paid the ransom: 51% of affected organizations paid the ransom. The median ransom paid was $1 million dollars, compared to a median demand of $1.2 million dollars.

●      Recovery costs and timelines are improving: The average cost to recover from a ransomware attack, excluding ransom payment, declined by 24% to $1.3 million dollars. 58% of manufacturers fully recovered within one week, up from 44% last year.

●      Ransomware incidents affect IT and security teams: 47% of manufacturers reported increased team stress after experiencing data encryption. 44% said pressure from senior leaders increased, and 27% reported leadership change as a result of the attack.

“Manufacturing depends on interconnected systems where even brief downtime can stop production and ripple across supply chains,” said Alexandra Rose, Director of Threat Research, Sophos Counter Threat Unit. “Attackers exploit this pressure: despite encryption rates falling to 40%, the median ransom paid still reached $1 million. While half of manufacturers stopped attacks before encryption, recovery costs average $1.3 million and leadership stress remains high. Layered defenses, continuous visibility, and well-rehearsed response plans are essential to reduce both operational impact and financial risk.”

 What Sophos is Seeing in Manufacturing

Over the past twelve months, Sophos X-Ops has observed ransomware activity across leak sites and found that 99 distinct threat groups targeted manufacturing organizations.

The most prominent groups targeting manufacturing organizations based on leak site observations are GOLD SAHARA (Akira), GOLD FEATHER (Qilin) and GOLD ENCORE (PLAY). Reflecting the trends revealed in the report, in over half of the ransomware incidents that

Sophos Emergency Incident Response was brought in to remediate, attackers both stole and encrypted data, highlighting the use of double extortion tactics where data is held for ransom and threatened with release on a leak site.

Strengthening Defenses for the Long Term

Based on its experience protecting manufacturing organizations worldwide, Sophos recommends the following best practices to help businesses stay ahead of ransomware and other cyberthreats:

● Eliminate Root Causes: Take proactive steps to address common technical and operational weaknesses—such as exploited vulnerabilities—that adversaries frequently target. Solutions like Sophos Managed Risk can help organizations assess their exposure and reduce risk across their environments.

● Defend Every Endpoint: Ensure all endpoints, including servers, are protected with dedicated anti-ransomware defenses to prevent attacks from gaining a foothold.

● Plan and Prepare: Establish and routinely test a comprehensive incident response plan. Maintain reliable backups and practice data restoration regularly to minimize downtime in the event of an attack.

● Monitor Around the Clock: Continuous visibility is essential. Organizations without in-house resources can strengthen their resilience by partnering with a trusted Managed Detection and Response (MDR) provider.

Corporate Affairs Commission (CAC) has warned Nigerians against dealing with 15 unregistered entities using company names and registration numbers that are not in the commission’s records.

In a public notice signed by CAC Management, the commission said it had discovered the use of purported company names and RC numbers that are not registered with the CAC, urging the public to disregard them and verify all business information directly from its portal.

“The CAC remains committed to protecting the integrity of the Companies Register, upholding the law, and ensuring a safe and transparent business environment in Nigeria,” the CAC said.

According to the notice, the following are the entities not registered with the CAC:

Famas Services Nigeria Limited (RC: 216312)

Promo Dutch Investment Limited (RC: 396654)

Dialack Concept Nig. Ltd (RC: 297772)

Purpleheart Construction and Real Estate Mgt. Co. Ltd (RC: 1210548)

M/S Loktu Enterprises (BN: 373466)

Loktu Enterprises (BN: 400390)

Badatoyak Ltd (RC: 521322)

Johson Nats Limited (RC: 198492)

Peoples Club Nigeria International (CAC/IT/41191)

Jiba Enterprise (BN: 577523)

Civil Engineering Solutions Nigeria Limited (RC: 33001)

Gabdoff Hotel Ltd (RC: 112409)

Amoka Group (BN: 545221)

BEEC Nigeria Limited (RC: 30143)

1. Adetunji (BN: 657466)

Explaining the reason for the commission’s publication, the statement noted that it aligns with its statutory role of maintaining an accurate and reliable companies register, protecting investors, and preventing fraudulent activities in the business environment.

The commission urged Nigerians to always confirm the status of any company or business name through its official portal.