Matthew RosenquistFounder & CISO Advisor, Cybersecurity Insights · CISO, Cybersecurity Strategist, & Industry Advisor

Unusual Cybersecurity Disruptions in Manufacturing

23 Oct 2023 · 3 min

Watch on YouTube

3:02

In this commentary, the speaker explains why cyber‑attacks on highly automated manufacturing plants can cause disproportionately long downtimes compared with other sectors. The discussion opens with the recent Clorox cyber‑attack, noting a roughly $10 million loss for the quarter and a projected 23‑28 % drop in net sales, illustrating the financial stakes. The speaker then walks through a concrete example of a high‑volume bread‑making factory: if a cyber‑incident disables packaging equipment, production must be halted in a prescribed sequence to avoid waste, and any work‑in‑progress (partially baked loaves, over‑proofed dough) must be scrapped. Restarting the line also requires a strict sequence, extending recovery time. Manual workarounds are highlighted as insufficient for maintaining pre‑attack throughput. Finally, the speaker emphasizes that factories operating on just‑in‑time supply chains or relying on third‑party logistics suffer amplified disruption, affecting supply feeds, delivery timing, and customer fulfillment. The overall message is an empathetic call to better understand and evaluate manufacturers’ crisis‑response capabilities.

Chapters

I wanted to talk for a minute about how cybersecurity events that disrupt complex manufacturing organizations can be special cases that incur more downtime than other sectors. I've seen some outrage recently regarding the cyber attack that impacted Clorox to the tune of about $10 million in quarterly losses. Now, this attack began mid-August and was mostly resolved by the end of September, so about half the quarter. Now, the company announced it expected a net sales decrease of 23 to 28%. I don't have any inside information, but those numbers actually seem reasonable to me. One thing we should keep in mind for highly automated manufacturing operations is the cascading impacts of unplanned outages. For example, imagine you own a high-production bread-making factory. If a cyberattack takes out your packaging equipment at the end of the production line, then you will quickly need to stop production so that you don't have an overflow of waste and create even more problems. So you will need to shut down in a predetermined sequence. Hopefully the problems are addressed in a short period, but cyberattacks can go on for hours, days, or even weeks. You might invoke a manual process, but that likely will be insufficient to keep the pace that you had before. Now, when the issue is resolved, all the work-in-progress bread products will need to be scrapped before the whole line can be restarted. See, things that are partially mixed, baked, or suffer from under or overreaction as part of the manufacturing process aren't good anymore. You can't save or restore a partially baked loaf or an overproofed batch of dough. Then the factory has to be brought back online in a specific sequence before production can return to normal. So getting the factory back up and running can be a pain and take more time than other types of businesses which recover quickly when services are restored. Outages like this can have a much greater impact, especially if the factory is designed for just-in-time supply chain or doesn't own their own shipping and logistics. I feel for those manufacturers. That have to deal with cyberattacks that screw up supply feeds, production, delivery timing, and customer fulfillment. And the more we understand their pain, the better our opinions are of their crisis response performance.