Half of manufacturers now stop ransomware before encryption, Sophos reports

Manufacturing companies are stopping more ransomware attacks before encryption occurs, but cybercriminals are responding by increasingly stealing data and resorting to extortion-only tactics, according to a new Sophos report.

The study found that only 40% of attacks on manufacturers resulted in data encryption—the lowest level in five years and a sharp drop from 74% last year. However, this defensive progress comes with a caveat: extortion-only attacks surged to 10% from just 3% in 2024, as attackers pivot their strategies to maintain leverage over victims.