Ransomware Hit 1,140 Industrial Firms in Q2 2026, Dragos Says

Dragos counted 1,140 ransomware incidents affecting industrial organisations in Q2 2026, a 12% rise from Q1. The finding points to a shift worth understanding: ransomware targeting industrial OT systems increasingly starts in the enterprise IT systems that support operational technology, rather than at the factory floor or the control room itself.

The source article is brief, and this post sticks to what it states: the 1,140 figure, the 12% quarterly increase, and the observation that attackers are increasingly abusing the enterprise systems that underpin OT. Where we go beyond that, we describe general security practice rather than new findings.

What Dragos found in Q2 2026

According to Dragos, 1,140 ransomware incidents affected industrial organisations in the second quarter of 2026. That is 12% higher than the first quarter. The headline number matters, but the more useful detail is the direction of attacker effort: enterprise systems that support OT are increasingly the point of entry.

For more detail on the underlying numbers, see our companion report, Q2 2026 Ransomware Hit 1,140 Industrial Firms via IT.

How ransomware moves from office IT into OT

Operational technology is the hardware and software that runs physical processes, such as production lines, power distribution and water treatment. IT is the familiar world of email, file servers, business applications and cloud services. In most industrial organisations the two are connected, because managers need production data, engineers need design files, and suppliers need access.

Those connections are what attackers use. Rather than attacking industrial controllers directly, a ransomware group can break into a business system, steal data or encrypt servers, and create enough disruption that operations slow or stop. Even when the control systems are never touched, a company may shut down parts of its production as a precaution or because it can no longer schedule, ship or invoice.

This is why the IT and OT split can be misleading. A plant can have well-protected controllers and still be knocked offline by a compromise of the systems around them.

Why enterprise software and exposed systems are the weak link

The Dragos finding highlights attackers abusing the enterprise systems that underpin OT. These tend to be large business applications that hold valuable data and are often reachable from the internet so that partners and remote staff can use them.

A concrete example is the Clop campaign against enterprise product lifecycle software. Our coverage of Clop ransomware hitting PTC Windchill and FlexPLM systems describes a data theft extortion campaign aimed at internet-exposed instances of those platforms. These systems store product designs and manufacturing information, which makes them attractive to extortion groups even when no production system is encrypted.

Exposure is also a matter of known flaws going unpatched. Our report on CISA adding four flaws to its Known Exploited Vulnerabilities catalog shows how quickly vulnerabilities in widely used enterprise and industrial products can move from disclosure to active attack.

What This Means For You

Most readers do not run a factory or a utility, but many depend on one. When an industrial organisation is hit, the effects can show up as delayed deliveries, supply shortages, service interruptions or personal data exposure. Customer and employee information held in enterprise systems can also be stolen during these incidents.

You cannot fix an operator's network, but you can reduce your own exposure as a customer, employee or supplier:

• If you receive a breach notice from a manufacturer or service provider, take it seriously and follow its guidance.
• Use unique passwords and multi-factor authentication on accounts tied to any industrial or utility provider.
• Be alert to phishing that references a recent incident, since stolen data is often reused in follow-up scams.

What organisations can do: segmentation, backups, MFA

For those responsible for industrial environments, the trend argues for hardening the connection points between IT and OT. These are standard defensive measures, not new findings from the Dragos report:

• Segmentation: Separate business networks from control networks, and limit what can cross between them. If IT is compromised, segmentation helps keep the incident away from operations.
• Backups: Keep offline or otherwise isolated backups of critical systems, and test restoring them. Backups only help if they work under pressure.
• Multi-factor authentication: Require it for remote access and for administrative accounts, particularly on internet-facing enterprise applications.
• Patching and exposure review: Identify which enterprise systems are reachable from the internet, and prioritise fixes for flaws known to be exploited.
• Incident planning: Decide in advance how to isolate affected systems and keep essential operations running.

Takeaways

The Dragos count of 1,140 incidents in Q2 2026 shows ransomware targeting industrial OT systems is growing, and that the path in often runs through the enterprise software around them. Take a few minutes to review your own exposure: turn on MFA, check that your backups are current and recoverable, and install pending updates. For concrete examples of how IT weaknesses become industrial risk, read our coverage of the Q2 2026 industrial ransomware data and the Clop campaign against enterprise PLM software.