Manufacturing Cyberattack Costs and Recovery Times (2026)
By the editors at Reliable
The short version: We found no U.S. government source that publishes a national cost figure for cyberattacks on manufacturers. What exists is a set of narrower numbers, each with its own scope.
The FBI's Internet Crime Complaint Center (IC3) logged 355 ransomware complaints from the Critical Manufacturing sector in 2025. Only Healthcare and Public Health had more.
Company disclosures give the firmest cost figures. They include about $27 million at Johnson Controls, about $29 million of net fiscal 2024 expense at Clorox, $11 million at Hasbro, NOK 800 million to NOK 1 billion at Norsk Hydro, and £196 million in one quarter plus a further £64 million in the next at Jaguar Land Rover (JLR). Each covers a different period and cost definition.
The largest figure in this guide, £1.9 billion for the JLR incident, is a modeled estimate of UK-wide impact from the Cyber Monitoring Centre. It was published in October 2025, and one of its key recovery assumptions was later overtaken by JLR's own reporting.
On recovery, the disclosures reviewed here describe operational disruption lasting from weeks to roughly a quarter. In a Sophos survey of 332 manufacturers hit by ransomware, 58% reported full recovery within one week. Sophos sells security products, and the survey is self-reported.
How We Evaluated
Independent editorial analysis based on publicly available government reports, securities filings, company disclosures, and published survey summaries.
Reliable Magazine does not sell cybersecurity software or services and has no commercial interest in routing readers toward any particular vendor. Reliable does not accept payment for rankings. Vendors may sponsor enhanced listings with additional detail, but editorial rankings are independent. Read our editorial policy.
We sorted every figure into three tiers and kept the tiers apart:
Government complaint data: the FBI IC3 annual reports.
Company disclosures: securities filings, results releases, and official incident pages from the affected manufacturers.
Modelled estimates and vendor surveys: the Cyber Monitoring Centre statement on JLR, plus Sophos and IBM publications, with the vendor's commercial stake stated at each use.
Three rules applied throughout. Each figure keeps its original currency, reporting period, and definition. Nothing is summed across companies or converted between currencies. A figure appears only if a named source page prints it.
What the FBI Counts: Ransomware Complaints From Critical Manufacturing
The FBI's 2025 IC3 Annual Report, released in April 2026, is the main federal count. IC3 received 3,611 ransomware complaints from all complainants in 2025, with adjusted losses of $32,320,105.
The report's chart of cyber threats to critical infrastructure shows 355 ransomware complaints and 52 data breach complaints from Critical Manufacturing. Healthcare and Public Health is the only sector with more ransomware complaints, at 460.
Earlier editions of the same report show 218 ransomware complaints from Critical Manufacturing for 2023 and 258 for 2024.
The 2025 report also says the ten most reported ransomware variants, a list that opens with Akira and Qilin, most affected three sectors: Critical Manufacturing, Healthcare and Public Health, and Government Facilities.
Three scope limits matter for anyone quoting these numbers.
Sector definition. IC3 uses the 16 critical infrastructure sectors maintained by CISA. CISA builds the Critical Manufacturing Sector around four industries: primary metals, machinery, electrical equipment and components, and transportation equipment. Food, chemical, and pharmaceutical producers are assigned to other sectors in the same framework.
A second manufacturing count. IC3 separately reports more than 1,400 ransomware complaints from organizations outside the critical sectors. It says 5% of those came from non-critical manufacturing and gives furniture and building materials as examples.
Loss definition. The report states that ransomware adjusted losses normally exclude lost business, time, wages, files, equipment, and third-party remediation services. It adds that some entities report no loss amount, and that the total covers only reports made through IC3.
For a manufacturer, those excluded categories are the ones company filings describe as the main costs. The $32 million IC3 total for all sectors is smaller than several single-company figures in the next section for that reason.
What Public Companies Disclose
Securities filings and results releases are the most specific cost sources available. Each figure below keeps its own currency, period, and definition.
Clorox (2023)
Clorox detected unauthorized activity on its IT systems in August 2023. Its Form 10-K for the fiscal year ended June 30, 2024 reports incremental costs of approximately $29 million for that fiscal year, net of insurance recoveries. That is a fiscal 2024 net expense figure and should not be read as the final cost of the incident.
The company recognized $30 million of insurance recoveries in the fourth quarter. The net amount was recorded as $17 million in cost of products sold and $12 million in selling and administrative expenses.
The filing says the costs relate primarily to third-party consulting, including IT recovery and forensic experts, plus incremental operating costs from the disruption. Clorox ran manual ordering and processing at a reduced rate of operations, and it reports order processing delays and significant product outages. The effect on net sales is described in the filing and sits outside the $29 million cost line.
The insurance picture changed after that filing. Clorox's Form 10-K for the fiscal year ended June 30, 2025 says the company recorded $70 million of insurance recoveries related to the cyberattack in fiscal 2025 and that no additional recoveries are anticipated. The same filing says the company has recovered from the August 2023 cyberattack.
Johnson Controls (2023)
Johnson Controls, which makes building equipment and controls, reported a cybersecurity incident that began during the weekend of September 23, 2023.
Its Form 10-Q for the quarter ended December 31, 2023 puts the impact on net income for that quarter at approximately $27 million. The figure combines lost and deferred revenues with expenses, is described as primarily response and remediation expense, and is net of insurance recoveries.
The company said it expected insurance to reimburse a substantial portion of its direct costs and business interruption losses.
Norsk Hydro (2019)
Norsk Hydro, the Norwegian aluminium producer, was hit on March 19, 2019. Hydro's 2020 financial statements estimate the financial impact at NOK 800 million to NOK 1 billion. The company says it received NOK 769 million in insurance compensation related to the event, with NOK 216 million recognized in 2019 and NOK 553 million in 2020.
Hydro's incident page says the Extruded Solutions business area suffered the most significant operational challenges and financial losses. The other business areas produced close to normal using work-intensive workarounds and manual procedures. Encrypted PCs and servers were rebuilt from backups.
Hasbro (2026)
Hasbro identified unauthorized access to its network in late March 2026 and proactively took certain systems offline.
Its second-quarter 2026 results release reports $11 million of direct incremental expenses for the six months ended June 28, 2026 and estimates the revenue impact at approximately $25 million. The company said it expects additional costs in future periods.
Hasbro's first-quarter Form 10-Q says it plans to submit claims to its cybersecurity insurers.
Stryker (2026)
Stryker, the medical device maker, identified a cybersecurity incident on March 11, 2026. Its Form 10-Q for the quarter ended March 31, 2026 says the company determined the incident to be material and that it resumed manufacturing operations shortly after March 11.
Its Form 10-Q for the quarter ended June 30, 2026 ties higher manufacturing and supply chain costs primarily to idle production time related to the incident.
No event-level dollar total was identified in the Stryker filings reviewed for this guide.
The Largest Modelled Loss: Jaguar Land Rover
JLR said on September 2, 2025 that it had been hit by a cyber incident, had proactively shut down its systems, and that its retail and production activities were severely disrupted.
Two very different figures describe the cost. They measure different things and should stay separate.
The company figures. JLR's results release of November 14, 2025 reports exceptional items of £238 million for the quarter ended September 30, 2025, of which £196 million were cyber related costs.
Its next results release, dated February 5, 2026, reports exceptional items of £74 million for the quarter ended December 31, 2025, including a further £64 million of costs related to the cyber incident. JLR reports the two quarterly amounts separately, and this guide keeps them that way.
Revenue for the quarter was £4.9 billion, down 24% year on year. JLR attributes the decline to two causes together: the production stoppages it initiated in September and the planned wind-down of legacy Jaguar models. The release gives no split between them. Revenue for the following quarter was £4.5 billion, down 39% year on year, with JLR citing the cyber incident alongside the Jaguar wind-down and weaker market conditions in China.
The economy-wide model. The Cyber Monitoring Centre (CMC), an independent UK non-profit that categorises cyber events, published a statement on October 22, 2025. It rated the incident a Category 3 systemic event on its five-point scale and modelled the UK financial impact at £1.9 billion, with a range of £1.6 billion to £2.1 billion.
The statement says the model estimates that over 5,000 UK organisations were affected. That count is a model output and has not been confirmed by JLR. The statement says the vast majority of the impact came from lost manufacturing output at JLR and its suppliers.
The CMC describes the work as scenario-based analysis using information available as of October 17, 2025. The estimate covers UK operations only and leaves out any ransom and any loss from the data breach.
A key assumption was later overtaken. The model assumed JLR would return to full production in early January 2026, with a straight-line recovery from October 8, 2025. JLR later reported that vehicle production had returned to normal levels by mid-November 2025. The assumed recovery was materially slower than the one JLR reported, so the £1.9 billion figure is best read as an October 2025 projection. The statement says later JLR disclosures will not change the event's rating.
The CMC flags its own limits. By its own account, the modelled loss is sensitive to inputs such as how long JLR takes to return to pre-event production. The range could run higher if operational technology was significantly affected. Some of its insights are anecdotal as opposed to verified JLR disclosures.
Two organisation counts appear in the statement and are easy to confuse. The Category 3 threshold refers to material financial impact on more than 2,700 UK organisations. The figure of over 5,000 is the count of organisations the model treats as affected.
Recovery Times: What the Record Shows
No source in this guide publishes an average recovery time drawn from audited incident records. The disclosures give individual timelines.
Clorox: the 10-K describes wide-scale disruption from the August 2023 incident through the quarter ended September 30, 2023, with lessening operational impacts starting the following quarter and a later return to substantially normalized operations.
Johnson Controls: the incident began the weekend of September 23, 2023. The 10-Q for the quarter ended December 31, 2023 still records lost and deferred revenue and response expenses.
JLR: the company announced the incident on September 2, 2025 and stopped vehicle production in September. The CMC statement puts the production halt at approximately five weeks, and JLR's February 5, 2026 release says vehicle production returned to normal levels by mid-November 2025.
Hasbro: access was identified in late March 2026. The second-quarter release says disruptions ran throughout the second quarter and that order processing, shipping, and invoicing had since returned to pre-incident practices.
Stryker: the incident was identified on March 11, 2026. The first-quarter 10-Q says manufacturing operations resumed shortly after.
Norsk Hydro: the incident page says normal operations have resumed and gives no duration.
Two recovery clocks appear in these disclosures.
The first is system and production restoration. Reported operational disruption ranged from weeks to roughly a quarter in the cases above.
The second is commercial catch-up. Clorox says some net sales missed in its first fiscal quarter were recognized in later quarters. Hasbro said in its first-quarter 10-Q that it expected most delayed shipping to be made up in the second half of 2026.
None of the sources reviewed here publishes an audited cost per hour of cyber downtime for manufacturing.
Vendor Surveys: Sophos and IBM
Two vendor publications supply the survey numbers most often quoted for manufacturing. Both companies sell security products and services, so each figure below carries that stake.
Sophos
The Sophos State of Ransomware in Manufacturing and Production 2025, announced December 3, 2025, is based on a survey of 332 manufacturing and production organizations hit by ransomware in the prior year. Sophos says all respondents represent organizations with between 100 and 5,000 employees. Sophos, a security vendor, reports:
Data was encrypted in 40% of attacks.
51% of organizations with encrypted data paid the ransom.
The median ransom payment was $1 million against a median demand of $1.2 million.
The average recovery cost, excluding any ransom, was $1.3 million, which Sophos describes as a 24% decline.
58% fully recovered within one week, up from 44% the year before.
These are self-reported answers from surveyed organizations. The $1.3 million average is a different measure from the company filing figures above, which come from firms large enough to file public reports.
IBM
IBM, which sells security software and services, publishes the annual Cost of a Data Breach Report.
IBM's industrial category is broader than manufacturing. An IBM release for the 2022 edition describes it as chemical processing, engineering, and manufacturing companies.
IBM's own summary of the 2024 edition puts the average total cost of a data breach in the industrial sector at $5.56 million. That ranked third among the 17 industries studied and stood above that edition's $4.88 million global average.
Trade press coverage of the 2026 edition, released July 29, 2026 and based on breaches at 602 organizations, reports an industrial sector average of $5.5 million against a global average of $4.99 million.
The IBM metric is built around data breach events and their response costs. It is a different measurement from the production-loss figures in company filings, and the two should be read separately.
The same IBM summary says unplanned downtime "could cost up to USD 125,000 per hour." The wording gives an upper-end illustration. This guide does not use it as a benchmark.
At a Glance
| Incident or dataset | Year | Reported figure | What it measures | Source | Recovery detail |
|---|---|---|---|---|---|
| Norsk Hydro | 2019 | NOK 800 million to NOK 1 billion; NOK 769 million insurance compensation | Company estimate of financial impact; compensation recognized in 2019 and 2020 | Hydro 2020 financial statements | Duration not stated; Extruded Solutions hit hardest |
| Clorox | 2023 | About $29 million; later $70 million insurance recoveries | Fiscal 2024 incremental costs net of $30 million recoveries; further recoveries recorded in fiscal 2025 | Forms 10-K, fiscal 2024 and fiscal 2025 | Wide-scale disruption through September 30, 2023 |
| Johnson Controls | 2023 | About $27 million | Net income impact in one quarter, net of insurance recoveries | Form 10-Q, quarter ended December 31, 2023 | Impact still recorded the quarter after the incident |
| JLR (company) | 2025 | £196 million, then £64 million | Cyber related exceptional costs in two consecutive quarters, reported separately | JLR results releases, November 14, 2025 and February 5, 2026 | Production stopped in September; normal levels by mid-November 2025 |
| JLR (UK economy) | 2025 | £1.9 billion (range £1.6 billion to £2.1 billion) | Modelled UK-wide financial impact, October 2025 projection | Cyber Monitoring Centre statement | Model assumed full production in early January 2026 |
| Hasbro | 2026 | $11 million expenses; about $25 million revenue impact | Direct incremental expenses and estimated revenue impact, first half of 2026 | Hasbro second-quarter 2026 release | Disruptions throughout the second quarter |
| Sophos survey | 2025 | $1.3 million average | Self-reported recovery cost excluding ransom, 332 manufacturers, vendor survey | Sophos press release | 58% fully recovered within one week |
Honest Limitations
No national total exists in these sources. Nothing here supports a single annual cost figure for cyberattacks on US or global manufacturing, and this guide does not construct one.
IC3 counts are complaints. Reporting to IC3 is voluntary, the Critical Manufacturing sector covers four industry groups, and the ransomware loss total excludes lost business and remediation services by the FBI's own description.
Company figures are a selected sample. They come from public companies that judged an incident worth disclosing. Privately held manufacturers, which rarely publish incident costs, are absent.
Definitions differ by company. Some figures are net of insurance recoveries, some are estimates of total cost, and some cover a single quarter. They are not additive. Insurance recoveries can also arrive in later fiscal years, as at Clorox.
The CMC figure is a model. It covers the UK only, depends on stated assumptions, and by the CMC's own account draws partly on anecdotal insight. Its assumed return to full production in early January 2026 was later than the mid-November 2025 recovery JLR reported.
Vendor surveys are self-reported. Sophos and IBM sell security products and services. IBM's sector figure measures data breaches across an industrial category that includes chemical processing and engineering firms. The 2026 IBM sector figure is cited from trade press coverage because the report itself is distributed by registration.
Older and newer events are left out. The 2017 NotPetya losses sit mainly in litigation records outside this source set. Incidents disclosed in the third quarter of 2026 are omitted because cost figures had not appeared in quarterly results when this guide was written.
Stryker has no cost line. No event-level dollar total was identified in the Stryker filings reviewed for this guide.
Frequently Asked Questions
How much does a cyberattack cost a manufacturer?
There is no single reliable average. Company disclosures reviewed here include about $27 million at Johnson Controls for one quarter, about $29 million at Clorox for fiscal 2024 net of insurance, $11 million in direct expenses at Hasbro for the first half of 2026, NOK 800 million to NOK 1 billion at Norsk Hydro, and £196 million followed by £64 million at JLR across two consecutive quarters. In a Sophos vendor survey of 332 manufacturers, the average self-reported recovery cost excluding ransom was $1.3 million.
How long does it take a manufacturer to recover from a ransomware attack?
It depends on what counts as recovered. In the Sophos vendor survey, 58% of manufacturers said they fully recovered within one week. Public company disclosures describe longer disruption: Clorox reported wide-scale disruption through the end of the quarter in which it was attacked, Hasbro reported disruptions throughout a full quarter, and JLR stopped production in September 2025 and reported that production returned to normal levels by mid-November 2025.
How many ransomware attacks hit manufacturers each year?
The FBI's IC3 recorded 355 ransomware complaints from the Critical Manufacturing sector in 2025, following 258 for 2024 and 218 for 2023. These are voluntary complaints from one sector definition that covers primary metals, machinery, electrical equipment, and transportation equipment. IC3 counts some other manufacturers separately, and unreported incidents are absent.
Why is the FBI's ransomware loss total so low?
IC3 reported $32,320,105 in adjusted ransomware losses for 2025 across all complainants. The FBI states that this number normally excludes lost business, time, wages, files, equipment, and third-party remediation services, and that some entities report no loss amount at all. Those excluded categories are the ones manufacturers describe as their main costs in securities filings.
What is the largest documented loss from a cyberattack on a manufacturer?
Among the sources in this guide, the largest figure is the Cyber Monitoring Centre's modelled £1.9 billion UK financial impact from the 2025 JLR incident, with a range of £1.6 billion to £2.1 billion. It is an October 2025 model of impact across JLR, its suppliers, and downstream organisations in the UK, and it assumed a slower recovery than JLR later reported. JLR's own results releases report £196 million of cyber related costs in one quarter and a further £64 million in the next. This guide does not rank the event against older global incidents such as NotPetya.
Does insurance cover manufacturing cyberattack losses?
The disclosures show partial and delayed recovery in specific cases. Clorox recognized $30 million of insurance recoveries in the fourth quarter of fiscal 2024 and a further $70 million in fiscal 2025, and said no additional recoveries were anticipated. Johnson Controls said it expected a substantial portion of its direct costs and business interruption losses to be reimbursed. Hasbro said it plans to submit claims to its cybersecurity insurers. None of these sources gives a general coverage rate for manufacturers.
Related Guides
Sources
FBI Internet Crime Complaint Center: 2025 IC3 Annual Report (complaints by critical infrastructure sector; 2023 and 2024 counts are in earlier editions on the same site)
Cybersecurity and Infrastructure Security Agency: Critical Manufacturing Sector (sector definition used by IC3)
U.S. Securities and Exchange Commission, EDGAR: The Clorox Company Form 10-K, fiscal year 2024 (the Clorox fiscal 2025 10-K and the Johnson Controls, Hasbro, and Stryker 10-Q filings cited above are on the same site)
Hydro: Financial statements and Board of Directors' report 2020 (financial impact and insurance compensation; the incident page is on the same site)
JLR: JLR Q3 Performance Impacted by Previously Indicated Challenges (February 5, 2026 results release; the November 14, 2025 release and September 2, 2025 statement are in the same newsroom)
Cyber Monitoring Centre: Statement on the Jaguar Land Rover Cyber Incident, October 2025 (Category 3 rating, modelled UK loss, and model assumptions)
Hasbro: Hasbro Reports Second Quarter 2026 Financial Results (direct expenses and revenue impact estimate)
Sophos: Sophos Report: Manufacturing Industry Blocks More Ransomware Attempts, While Adversaries Shift to Data Theft (vendor survey of 332 manufacturers; survey method is on the Sophos blog)
IBM: Cost of a data breach: The industrial sector (vendor summary of the 2024 edition; the industrial category definition is in IBM's 2022 edition release)
Infosecurity Magazine: The Average Cost of a Data Breach Rises to $5 Million (trade press report of the 2026 IBM edition's sector figures)