Ransomware in OT environments: why it’s different and how to recover

OT ransomware is not IT ransomware with an industrial label. An encrypted HMI, engineering workstation, SCADA server or virtualization host can remove operator visibility and force a controlled shutdown even when PLCs continue running. Recovery ends only when operations, engineering, safety and security agree that restored systems and the physical process are trustworthy.

Quick definition: What is OT ransomware?OT ransomware is ransomware or data extortion that compromises systems supporting physical operations. It becomes an OT event when it threatens production, visibility, control or safe recovery, whether or not it encrypts a PLC.

Key takeawaysThe OT recovery objective is a verified safe operating state, not merely restored files or a booting server.Industrial ransomware often reaches operations through IT, identity, remote-access, virtualization or supplier dependencies.Recovery copies must be isolated, tested and protected from alteration, then restored in an engineering-defined sequence.A local operator may execute an approved workstation restore, but operations, engineering, safety and security still control the restart decision.

OT ransomware is different because availability is tied to a physical process, and a booting server is not proof of a safe restart. Ransomware in OT environments more often disrupts Windows-based HMIs, engineering workstations and SCADA platforms than lower-level controllers. Losing supervisory visibility or control can still require a shutdown.

Recovery must follow process dependencies. Before energizing equipment or reintroducing pressure, flow or chemical reactions, teams may need to verify device state, control configuration, alarm limits, process values and controller logic. Perform calibration checks where plant procedures, equipment condition, OEM guidance or regulation requires them, rather than assuming every device needs recalibration.

Ransomware operators also tamper with recovery mechanisms, including shadow copies and backup systems. That makes isolated copies and rehearsed recovery part of OT ransomware protection, not an administrative afterthought. For broader context, see OT and ICS cybersecurity explained.

Reporting for 2025 and early 2026 shows sustained ransomware pressure on industrial organizations, with manufacturing prominent across multiple datasets. Dragos reported a 49% annual increase in ransomware groups affecting industrial organizations in 2025 and more than 3,300 affected organizations worldwide. Separately, in Acronis's Q1 2025 public-disclosure dataset, manufacturing was the most targeted industry, accounting for 15% of recorded ransomware cases. These datasets use different scopes and should not be combined into a single growth calculation.

In the SANS 2025 State of ICS/OT Security Survey, 22% of respondents reported an ICS/OT cybersecurity incident in the previous 12 months. Among the incident types reported, 38% involved ransomware. Nearly half of incidents were detected within 24 hours, yet 19% took more than a month to remediate. These findings describe the complexity of restoring a validated physical process, not negligence by industrial teams. See why manufacturing OT needs a resilience-first approach.

Recent incidents show that production can stop when IT and supervisory dependencies fail, even without confirmed encryption of field control assets.

Jaguar Land Rover, 2025: An Acronis manufacturing resilience white paper describes the 2025 Jaguar Land Rover cyberattack as disrupting U.K. production for several weeks, with estimated costs of at least £50 million per week and job losses. The approved material uses the incident to show how enterprise IT disruption can directly affect factory operations. It does not classify the incident as ransomware, so JLR remains a manufacturing cyber-disruption comparison rather than a confirmed ransomware case.

Colonial Pipeline, 2021: SalesFirst ransomware materials describe the DarkSide attack as affecting Colonial Pipeline’s billing system and internal business network, disrupting service and leading to a ransom payment of approximately $4.4 million. The example supports the operational lesson that disruption to business systems can affect industrial service availability without establishing direct SCADA or HMI encryption.

JBS Foods, 2021: JBS confirmed an $11 million payment. The company said it voluntarily shut down systems, its encrypted backup servers were not infected and it prioritized restoring production-critical systems. JBS reported losing less than one day’s production. Its statements do not establish direct SCADA encryption.

Romanian Waters, 2025: The incident affected approximately 1,000 computers or systems across 10 of 11 regional offices, including email, databases, web portals and GIS tools. An official notice said OT was not affected, and hydrotechnical structures continued local operation coordinated through dispatch and voice communications. The initial assessment found malicious use of Windows BitLocker, and a subsequent DIICOT criminal-investigation notice separately recorded ransomware-related data encryption.

Ransomware can disrupt OT through enterprise, remote-access or supplier pathways by compromising systems operations depend on. Among respondents reporting ICS/OT incidents in the SANS 2025 survey, 50% cited unauthorized external access, 38% ransomware and 30% supply-chain compromise as incident types. These categories are not a mutually exclusive initial-access distribution. In a separate Acronis analysis of 2025 MSP and telecommunications-provider cases, phishing accounted for 52% of recorded initial-access vectors, unpatched vulnerabilities for 27%, credential abuse for 13%, trusted relationships for 5% and RDP for 3%. The report also describes exploitation of unpatched software as the dominant initial-access vector specifically in MSP and supply-chain ransomware incidents.

Common paths include stolen VPN or jump-host credentials, exposed RDP, poorly governed vendor access, compromised identity services and vulnerable management platforms. Dragos linked a Q1 2025 CL0P surge to exploitation of Cleo Managed File Transfer vulnerabilities. It also documented ransomware operators exploiting SimpleHelp remote-management flaws for remote code execution and privilege escalation.

Legacy patching remains an engineering and scheduling decision. Prioritize internet-facing VPN, RDP and management infrastructure, then use compensating controls and maintenance cycles for assets that cannot be changed immediately. See securing legacy OT systems without disrupting operations.

Effective OT ransomware protection narrows attack paths, detects destructive behavior early and protects recovery data from the identities and systems used in production.

• Segment IT and OT: Use zones, controlled conduits and an OT DMZ so an enterprise compromise cannot communicate freely with supervisory assets.
• Control remote access: Use approved gateways or jump hosts, verify user and device identity, limit privileges and record or approve sensitive sessions.
• Use compatible local protection: Monitor for ransomware-type actions such as backup tampering and rapid encryption. Acronis Cyber Protect for OT supports local protection and recovery in offline and air-gapped environments. Available cybersecurity capabilities depend on the selected deployment and configuration.
• Patch by consequence and exposure: Prioritize internet-facing VPN, RDP and management systems, then coordinate plant changes with OEM requirements and maintenance windows.
• Isolate recovery copies: Maintain tested offline or immutable copies in a separate trust path from production credentials. Immutability depends on supported storage architecture and correct policy configuration. It protects the backup itself, but it does not neutralize data already exfiltrated or replace containment and investigation.

The backup strategies for operational technology systems guide provides more detail on full-system protection for legacy and isolated environments.

OT ransomware recovery should move from process safety to trusted recovery and only then to a staged restart. For teams asking how to recover from ransomware in OT, the practical sequence is:

First, establish the safe state and decision authority. Operations and facility safety leaders determine whether the process can continue, move to an engineered manual mode or must stop. Security and IT advise on cyber scope, but they do not unilaterally authorize a physical restart.

Second, contain the compromise and define the trust boundary. Isolate affected systems, preserve evidence, identify exposed identities and stop re-entry before reconnecting restored assets.

Third, restore in plant-defined dependency order. Recover trusted identity, time, network and backup services as required, then production-critical servers, engineering workstations, HMIs and dependent applications. JBS’s production-first sequence illustrates the principle.

Fourth, validate the restored state. Compare images, settings, controller logic, alarm limits and device configuration with known-good baselines. Confirm process values independently and perform calibration checks where procedures, equipment condition or regulation requires them.

Fifth, restart in stages. Operations, engineering and safety authorize each transition, observe process behavior and retain a rollback path.

When a known-good image must move to different replacement hardware, Acronis Universal Restore can retain the backed-up operating system, applications, files and configuration while adapting hardware dependencies. It does not validate the plant process. A trained and authorized operator may execute a predefined local workstation restore, but incident response and restart authority remain cross-functional. See how OT teams can recover faster after a cyberattack.

A recoverable site has seven capabilities prepared, assigned and tested before an industrial ransomware attack begins.

One: Immutable backups isolated from production credentials. Use supported immutable storage with suitable retention and a separate administrative trust path. Immutability protects recovery data, not data already stolen from production.

Two: A predefined recovery sequence. Map dependencies, assign each step and document what must be available before the next asset returns.

Three: State, configuration and calibration-validation procedures. Define known-good baselines, independent process checks and recalibration triggers.

Four: Acronis Universal Restore or another dissimilar-hardware recovery capability. Be ready to restore a system image when identical legacy hardware is unavailable.

Five: An operator-led recovery workflow. Train authorized operators or site technicians to execute a predefined workstation restore while keeping incident response and restart authority cross-functional.

Six: Compatible local protection for restricted-connectivity environments. Use protection suited to the selected deployment and configuration, including offline or air-gapped environments where applicable.

Seven: A tested recovery plan. Run OT ransomware exercises regularly, with frequency based on risk, regulation and operational change. In the SANS 2025 survey, 39% of organizations with incident-response plans tested them annually and 25% tested quarterly. Separately, 32% reported annual tabletop or hands-on testing of ICS/OT-specific resilience plans. These measures describe different testing activities and should not be treated as one universal cadence. Test technical dependencies and restart gates under realistic site constraints. The plan is complete only when the site can demonstrate a safe operating state.

Acronis Cyber Protect for OT supports secure backup and operator-led recovery for the PC-based systems that support industrial operations, including systems in segmented and air-gapped environments.

Acronis Cyber Protect for OT combines full-system backup and restore, local operator-led recovery and hardware-independent recovery for PC-based OT systems. It supports a broad range of legacy and current Windows and Linux systems used in OT. Check the current Acronis Cyber Protect support documentation for individual versions and configurations.

Acronis protects and recovers the PC-based systems that support operations. Operations, engineering and safety teams remain responsible for validating the physical process and authorizing restart.

Acronis Cyber Protect for OT supports local protection and recovery in offline and air-gapped environments. Available cybersecurity capabilities depend on the selected deployment and configuration.

In supported Acronis immutable-storage configurations, deleted backups remain available during the defined retention period and cannot be changed, moved or deleted during that period. Support depends on deployment type, storage, agent version, backup format, mode and retention settings. Immutability strengthens recovery, but it does not stop production compromise, credential theft or exfiltration. Containment, credential rotation and investigation remain necessary.

Acronis Universal Restore separates a backup from hardware dependencies while retaining the operating system, applications, files and configuration, then installs appropriate drivers on the target machine. The product page names the branded local restore capability Acronis One-Click Recovery. The broader process remains operator-led recovery: an authorized operator can execute a predefined workstation restore, but no restore action completes incident response, validates the physical process or authorizes plant restart.

See the Acronis Cyber Protect for OT technical overview and immutable backup guide for product details.

Practitioners should plan for uncertain timelines, separate decryption from safe restart and test manual and technical recovery within production constraints.

There is no universal OT ransomware recovery time. SANS reported that 19% of surveyed ICS/OT incidents took more than a month to remediate. Duration depends on forensic scope, process complexity, equipment availability and the checks needed to reach a validated operating state.

No. Payment does not guarantee file recovery, remove attacker access or verify control-system integrity. Even when a decryptor works, investigation, credential rotation, baseline comparison and process-safety validation remain necessary before restart.

Sometimes, but only when manual or local operation has been engineered, documented and tested. Romanian Waters reported that hydrotechnical structures continued local operation coordinated through dispatch and voice communications while affected IT systems were unavailable. Manual operation should not be improvised during an incident.

Run OT ransomware exercises regularly, with frequency based on risk, regulation and operational change. Drill technical procedures during maintenance windows, in laboratories or in digital twins so teams can verify media, credentials, boot paths, hardware compatibility and handoffs without unnecessary production change.

Protect full-system images and configuration data for production-supporting workstations and servers, including the operating system, applications, files and settings. Preserve known-good baselines, license material, recovery media and dependencies, then define the order in which the process needs them restored.

The newest copy is not automatically the safest. Select a point from before known malicious activity, then verify the image and check for precursor malware or persistence. Operations and data owners should assess any data loss since that point before recovery begins.

Yes. Air gaps reduce exposure but do not remove risks from maintenance laptops, transient media, supplier access or local operational dependencies. Acronis OT materials explicitly position air-gapped operation as one deployment requirement alongside recovery from hardware failure, software problems, operator error and insider-borne cyberattacks. Isolation is therefore one layer, not a guarantee.

Estimate the potential operational impact of an outage with the ICS/OT downtime cost calculator.