Why Utah Manufacturers Are the #1 Target for Cyberattacks in 2026 (And What to Do About It)

If you run a manufacturing operation in Utah, I need you to sit with an uncomfortable fact for a moment: your industry has been the single most targeted sector for cyberattacks three years in a row. Not healthcare. Not finance. Manufacturing.

According to Bitsight’s 2025 State of the Underground report, manufacturing accounted for 22% of all cyberattacks where sector attribution was possible. Ransomware attacks against manufacturers surged 61% in a single year—from 520 incidents to 838. And between 2024 and early 2025, there was a 71% spike in threat actor groups specifically targeting manufacturing, with 29 distinct groups going after the sector.

This isn’t a distant problem. Utah is forecast to lead the nation in manufacturing job growth through 2033, according to a Deloitte and Manufacturing Institute report. That growth is great news for our state’s economy. It also means more manufacturers coming online, more systems getting connected, and more targets for attackers who already know this industry tends to underinvest in cybersecurity.

Why Hackers Love Manufacturers

Here’s the blunt truth: manufacturers make ideal ransomware targets because they can’t afford downtime.

When a law firm gets hit with ransomware, lawyers can work from legal pads for a day while IT sorts things out. When a manufacturing line goes down, you’re bleeding money by the minute. Siemens estimates that unplanned downtime costs Fortune 500 manufacturers roughly 11% of their annual revenue—about $1.5 trillion worldwide. For a small Utah shop doing $5 million a year, even a few days of downtime could mean a $50,000+ hit.

Attackers know this math. They know you’re more likely to pay the ransom because the alternative—days or weeks of halted production, missed shipments, angry customers—is worse. And 51% of small businesses that get hit with ransomware do pay, according to recent cybersecurity research.

But there’s a deeper issue specific to manufacturing that makes the risk even worse.

The IT/OT Problem Nobody Talks About

Most Utah manufacturers I’ve talked to have two worlds running side by side: their IT systems (email, accounting, ERP) and their operational technology—the PLCs, SCADA systems, CNC machines, and industrial controls that actually run the production floor.

Ten years ago, these systems were completely separate. Your CNC machine wasn’t connected to the internet. Your SCADA system ran on its own isolated network. That air gap was your security.

Those days are gone.

Industry 4.0, IoT sensors, remote monitoring, cloud-based ERP systems—all of these innovations have connected your OT environment to your IT network, and usually to the internet. That’s fantastic for efficiency. It also means that a phishing email that compromises an office computer can now potentially reach your production floor.

The scary part? Most OT systems were never designed with cybersecurity in mind. They run outdated operating systems that can’t be patched. They use default passwords. They have no logging or monitoring. When NIST published its Cybersecurity Framework 2.0 Manufacturing Profile in late 2025, they specifically called out this IT/OT convergence as the single biggest risk factor for small manufacturers.

Real Scenarios That Should Keep You Up at Night

Let me paint a few pictures that might hit close to home:

The invoice scam. Your accounts payable person gets an email that looks like it’s from your steel supplier. The invoice looks right, the amount looks right, but the bank routing number has been changed. You wire $47,000 to a criminal’s account. This is the most common attack against small manufacturers, and it works because attackers spend weeks studying your vendor relationships first.

The ransomware shutdown. An employee clicks a link in what looks like a shipping notification. Within hours, your ERP system is locked, your production schedules are encrypted, and your CNC machines are frozen. The ransom demand: $250,000 in Bitcoin. Your last backup was three weeks ago—and it was stored on the same network that just got encrypted.

The quiet data theft. A nation-state group (and yes, they target small Utah companies) spends months quietly exfiltrating your CAD files, supplier lists, and pricing data. You won’t even know it happened until your competitor in another country starts undercutting your bids with suspiciously similar products.

These aren’t hypothetical. They’re happening to manufacturers across the country every week.

The 10-Point Cybersecurity Checklist for Utah Manufacturers

You don’t need a six-figure security budget to dramatically reduce your risk. Here’s where to start, in order of impact:

1. Segment your network. This is the single most important thing you can do. Your office network and your production floor should be on completely separate network segments. If an attacker compromises a workstation in accounting, they should not be able to reach your PLCs. NIST has a free guide specifically for small manufacturers on how to do this.

2. Implement multi-factor authentication everywhere. Only 20% of small businesses use MFA, and 80% of breaches involve compromised credentials. This is the easiest win available to you. Every system that supports it—email, VPN, ERP, remote access—should require MFA. No exceptions.

3. Back up offline, test monthly. Your backups need to be disconnected from your network. An external drive in a fire safe, a cloud backup with immutable storage—something an attacker can’t reach. And test your restores. A backup you’ve never tested is just a hope.

4. Train your people. Employees at small businesses experience 350% more social engineering attacks than those at large enterprises. Run quarterly phishing simulations. Teach your shop floor workers that the USB drive they found in the parking lot is not free music—it’s an attack vector.

5. Patch what you can, isolate what you can’t. I get it—you can’t update the Windows XP machine running your $200,000 CNC machine. But you can put it on its own network segment with strict firewall rules. Patch everything else aggressively, especially internet-facing systems.

6. Get endpoint protection on every machine. Consumer antivirus isn’t enough. You need endpoint detection and response (EDR) that can spot suspicious behavior, not just known malware signatures. This includes office workstations, servers, and any IT systems connected to your OT environment.

7. Secure your remote access. If your vendors or your team can remote into machines from home, that’s a VPN-only, MFA-required connection. No exposed RDP ports. No shared credentials. No “we’ll just use TeamViewer with the same password.”

8. Create an incident response plan. When (not if) something happens, who do you call? What systems do you shut down first? Where are your offline backups? How do you communicate with customers about delays? Write this down now, when you’re calm, not during the chaos of an active breach.

9. Review your cyber insurance. Only 17% of small businesses carry cyber insurance, and many policies exclude manufacturing-specific risks like OT system damage or production loss. Talk to your broker about what’s actually covered. The average SMB cybersecurity incident costs between $826 and $653,587—can you absorb that?

10. Inventory your connected devices. You can’t protect what you don’t know about. Walk your facility and document every device connected to your network—sensors, cameras, smart thermostats, that old printer nobody remembers connecting. Each one is a potential entry point.

Utah-Specific Resources

Utah manufacturers have some advantages worth leveraging. The Utah Manufacturing Extension Partnership (Utah MEP) offers cybersecurity assessments specifically designed for small manufacturers, often at subsidized rates. They understand the unique challenges of protecting a shop floor, not just an office.

Additionally, Utah’s growing tech ecosystem means there’s no shortage of cybersecurity talent and managed service providers who understand manufacturing environments. You don’t need to figure this out alone.

The Bottom Line

Utah’s manufacturing sector is booming, and that’s worth celebrating. But growth without security is just building a bigger target. The attackers have already identified manufacturing as the most profitable industry to hit, and they’re getting more sophisticated every quarter.

The good news? Most of the checklist above doesn’t require massive investment. Network segmentation, MFA, offline backups, and employee training will stop the vast majority of attacks. Start there, and you’ll be ahead of 80% of manufacturers your size.

If you’re not sure where your vulnerabilities are, start with a security assessment. Know what you’re working with before you start spending money on solutions. That’s not a sales pitch—it’s just common sense.

Your production line depends on it.