By Gregory Hale
Cyber incidents causing physical impacts in heavy industry and critical infrastructure dropped to 57 in 2025 from 76 the previous year, a 25 percent decline, a new report found.
https://www.isssource.com/ot-threat-report-physical-impacts-down-nation-state-attacks-on-rise/
Most of this decline appears to be from a reduction in ransomware attacks because of a number of factors, however, there was an increase in the amount of nation-state and hacktivist attacks, which doubled over the previous year, with most such attacks targeting critical infrastructures, according to the Waterfall/ICS STRIVE 2026 OT Cyber Threat Report.
RELATED STORIES
- Stryker Ramping Up Manufacturing
- Cyberattack at Animal Product Maker
- Oil & Gas Producer Hit in Cyberattack
- Cyberattack at MA Contract Manufacturer
In terms of ransomware attacks, techniques are changing and while there are threat actors that still encrypt data and lock up systems, right now the predominant attack appears to be stealing data and threatening to expose it and the victim will pay. Having said that, the vast majority of attacks causing physical consequences remains ransomware.
Ransomware Attacks
Two classic examples of ransomware attacks where Jaguar Land Rover auto manufacturer shut down for over a month, according to the Waterfall/ICS STRIVE 2026 OT Cyber Threat Report. The company reported direct costs of recovery at $258 million. Total losses for the company are estimated at over $1 billion, with a total impact on the UK economy, including Jaguar’s suppliers, at $2.5 billion.
Another ransomware attack occurred at United Natural Foods, which impaired order processing and distribution by the food wholesaler for 30,000 retailers. The company lost $400 million in sales and spent $25 million in incident mitigation costs and reported a net loss of over $50 million on the quarter.
In terms of nation-state and hacktivists, attacks doubled in 2025 over 2024, with 5 of the 14 attacks clearly linked to the kinetic conflict between Russian and Ukraine. This report tracks hacktivists and nation states together, because unlike many ransomware criminals, both hacktivists and nation states deliberately try to bring about physical consequences.
This report documents cyberattacks with physical consequences. The Waterfall/ICS STRIVE report looks at incidents that occurred over the past year that resulted in physical consequences for the victim. By reviewing the report, it is especially important to use today’s threat data and trends to anticipate the environment for defenses in the future.
This report tracks cyberattacks that caused physical consequences in heavy industry and critical industrial infrastructure in the public record. It includes attacks that affect only IT assets, so long as they have physical/production consequences, because physical consequences from all cyber causes are of concern to owners and operators.
Click here to learn more details on this important industry report.