Manufacturing Incident Cost: OT Downtime, Ransomware, and the NotPetya Legacy in 2026
Manufacturing incident cost is the most under-reported of any industry because the dominant exposure is operational rather than data-related. The IBM CODB 2026 industrial-sector mean of $5.50M counts breach math; it does not count production-line downtime, supply-chain disruption, expedited freight, customer make-whole, or the long-tail capital cost of OT (operational technology) hardening. The cleanest public benchmarks (Norsk Hydro about $80M, Maersk $200-$300M direct from NotPetya, and Clorox's 20% quarterly sales drop) make clear that the operational layer is the driver.
OT/IT Convergence: Why Manufacturing Is Different
Modern manufacturing runs on the convergence of information-technology systems (ERP, MES, supply-chain planning) and operational-technology systems (PLCs, SCADA, HMI, robotic controllers, batch-process management). The convergence has produced enormous productivity gains and a correspondingly enormous attack surface. A ransomware operator that lands in the IT estate can frequently traverse to the OT estate via flat networks, dual-homed engineering workstations, vendor remote-access channels, or shared credentials.
When a ransomware reaches OT, the manufacturer faces a binary choice familiar to healthcare ransomware victims: pay the ransom and accept the residual risk, or shut production lines down for the duration of recovery. Recovery time for a manufacturer with no OT-specific backups, no tested OT recovery runbook, and shared IT/OT credentials is measured in weeks, not days. Norsk Hydro 2019 published a transparent post-incident accounting of full recovery taking months and costing approximately $80M.
The segmentation decision. IEC 62443 zones and conduits is the reference architecture for OT segmentation. No public source prices it or the loss it avoids for a typical manufacturer, so build the case from your own numbers: your downtime cost per hour (Siemens' published sector figures are a starting point), multiplied by the recovery time a flat IT/OT network implies, against the implementation quotes you receive.
Per-Line, Per-Hour Downtime Cost by Manufacturing Type
Per-hour production downtime cost is the central operating metric for manufacturing incident planning and the input to any loss estimate. The only recent cross-sector published figures are Siemens' True Cost of Downtime 2024, a survey of 181 maintenance, engineering and IT professionals at large manufacturers covering April 2019 to March 2023. Siemens publishes the figures below; for any other sub-sector, compute your own from lost contribution margin per hour plus idle wages.
| Sector (Siemens) | Per-Hour Downtime Cost | Annual Downtime Cost per Plant |
|---|---|---|
| Automotive (large plant) | $2.3M | $695M |
| Heavy industry | Chart only, not stated in text | $59M |
| Fast-moving consumer goods | $36,000 | Just over $10M |
| Small and mid-sized manufacturers | Up to $150,000 (top end) | Not published |
Source: Siemens, The True Cost of Downtime 2024 (report PDF). Figures are for large plants surveyed by Siemens; your plant's figure depends on its own throughput and margin.
The NotPetya Legacy
NotPetya in June 2017 remains the single most expensive cyber-incident in recorded history, and most of the disclosed cost landed on manufacturers, shippers, and pharmaceutical firms rather than tech or finance. The malware was attributed by the US, UK, and EU to Russian state actors targeting Ukraine; collateral damage to non-Ukrainian organisations was disproportionately industrial.
| Organisation | Disclosed Cost | Notes |
|---|---|---|
| Maersk (shipping) | $200-$300M direct | Full Active Directory rebuild from one surviving Ghana domain controller |
| Merck (pharma) | $1.4B+ insurance claim | Insurers lost the war-exclusion argument at trial and on appeal; the case later settled |
| FedEx (TNT Express) | $300M+ | Disclosed in Q1 FY18 results; permanent loss of TNT package volume |
| Mondelez (CPG) | ~$100M direct | Settled 2022 with Zurich after multi-year war-exclusion litigation |
| Saint-Gobain (construction) | €250M+ Q1-Q2 sales impact | Q2 2017 sales drop of approximately €220M |
| Total worldwide (estimate) | $10B+ | Per White House Council of Economic Advisers and various reinsurer estimates |
The legal legacy is as important as the financial damage. The Merck v. ACE case (decided in Merck's favour at trial in 2022 and by the New Jersey Appellate Division in 2023, then settled) and the Mondelez v. Zurich case (settled 2022) together established that the standard 'hostile or warlike action' exclusion in cyber insurance does not apply to NotPetya-style nation-state collateral damage. Insurers responded with explicit cyber-war exclusion language (Lloyd's mandated exclusions effective April 2023). Manufacturers buying cyber coverage in 2026 should expect explicit war-exclusion language and should negotiate carve-backs for collateral-damage scenarios.
The Critical-Infrastructure Benchmarks
Three 2021-2023 incidents reset baseline expectations on the cost and externality of OT-impacting cyber-attacks: Colonial Pipeline (May 2021), JBS USA (May 2021), and Clorox (August 2023). Each is publicly documented and serves as a cleaner-than-average benchmark.
| Incident | Year | Direct Cost | Operational Impact |
|---|---|---|---|
| Colonial Pipeline | May 2021 | $4.4M ransom paid; total not itemised | 6-day shutdown; declared national emergency; fuel shortages US Southeast |
| JBS USA | May 2021 | $11M ransom paid; total not disclosed | Multi-day production halt at major US beef plants |
| Clorox | August 2023 | $49M attack costs (six months to Dec 2023, 10-Q) | Q1 FY24 net sales down 20%, $1,740M to $1,386M; not described by Clorox as ransomware |
| Toyota (Kojima Industries) | Feb 2022 | undisclosed direct | 14 plants down 1 day; ~13,000 vehicles lost; supplier compromise |
| Norsk Hydro (LockerGoga) | Mar 2019 | $80M+ | Most transparent OT-incident disclosure on record; refused to pay ransom |
Sources: CISA incident summaries, public 10-K and 10-Q filings, official press statements.
Cyber Insurance Market for Manufacturers
Cyber insurance for manufacturers in 2026 is meaningfully harder to place than in 2020, particularly for organisations with significant OT exposure. Underwriters now require detailed OT-specific control attestations: network segmentation, no flat IT/OT networks, no shared credentials, MFA on all remote access including vendor access, tested recovery procedures with last-test date, and OT-aware EDR or specialised monitoring. Per-event sublimits for ransomware are now common rather than optional.
The Lloyd's-mandated war-exclusion language effective April 2023 has produced active negotiation around carve-backs. Manufacturers with potential collateral-damage exposure (those operating in or with supply-chain to conflict zones, or with significant Eastern European exposure) are negotiating named-event carve-backs; price them against the catastrophic scenario they cover.