Ransomware is the cyber threat most likely to actually stop your operation. Pipelines, food producers, water utilities, and manufacturers have all taken production offline - sometimes for weeks - after crews encrypted the Windows-based SCADA servers their operators depend on. The good news: ransomware is also the most defensible threat in OT security, because the playbook is well understood. This guide walks through how industrial ransomware incidents typically unfold, and the five defensive layers that decide whether yours is a bad afternoon or a bad month: segmentation, hardened access, immutable tested backups, early detection, and a rehearsed recovery plan.
Explore the full security & certification article series - 60+ practitioner guides.
Almost every publicly documented industrial ransomware case follows the same arc, and none of it is exotic. Initial access comes through the IT side: a phishing email that harvests a credential, a remote-access service exposed to the internet without multi-factor authentication, or a vulnerable edge device that was never patched. From there, attackers move laterally - often for days or weeks - collecting credentials and mapping the network before triggering encryption broadly, timed for maximum leverage.
What matters for an OT operator is the last hop. In some incidents, ransomware crosses into the OT network directly, because the plant network was flat or shared a Windows domain with corporate IT. In many others - Colonial Pipeline, the incident behind the joint CISA/FBI DarkSide ransomware advisory (AA21-131A), is the best-known example - the OT systems were never encrypted at all, yet operations still shut down as a precaution because the company could no longer trust its visibility, billing, or safety margins. Both outcomes stop production. Your defenses have to address both: keeping malware out of OT, and keeping enough trusted visibility and recovery capability that an IT-side incident does not force a plant-wide stop.
Note what is not on that list: zero-day exploits against PLCs. Ransomware crews are businesses; they take the cheapest path in, and the cheapest paths are credentials, exposure, and flat networks. That should shape where you spend first.
In IT, ransomware costs data and time. In OT, it costs production, and sometimes safety margin. Three differences drive that:
For the deeper background on why IT security playbooks translate poorly to plants, see our companion piece on OT vs IT security differences.
Segmentation is the single control that most reliably turns an enterprise-wide ransomware event into an IT-only event. The principles are the same ones the ISA/IEC 62443 series of standards formalizes as zones and conduits: group assets by criticality, and force every crossing between groups through a firewall with explicit, minimal rules. In practice, the ransomware-relevant rules are:
Our secure SCADA for OT networks guide covers zone-and-conduit design in more depth, including where data diodes fit.
Exposed remote access and weak credentials are the front door in the majority of industrial ransomware cases. The fixes are unglamorous and high-yield:
This is one place a modern platform does the heavy lifting for you: Merobix ships TOTP MFA and FIDO2 passkey support, role-based access with site-level authorization, brute-force detection with persistent account lockout, and session expiry and revocation as standard platform behavior - the full control set is documented on the security page.
Ransomware crews know backups are your alternative to paying, so mature crews hunt them: encrypting network-attached backup shares, deleting snapshots, and using stolen administrator credentials to purge cloud backup accounts before triggering encryption. This is why the joint #StopRansomware Guide from CISA, the FBI, and NSA puts offline, encrypted, regularly tested backups at the top of its preparation list, and why CISA's data backup options guidance (PDF) recommends the 3-2-1 pattern. A backup strategy that survives that behavior looks like this:
| Backup Approach | Survives Share Encryption | Survives Stolen Admin Credentials | Restore Speed | Verdict |
|---|---|---|---|---|
| Online copies on a network share / NAS | No - encrypted along with everything else | No | Fast (if it survives) | Convenience copy only; never your last line |
| Snapshots on the same infrastructure | Sometimes | No - deletable with admin access | Fast | Useful first resort; insufficient alone |
| Offsite copies, same credentials | Yes | No - reachable and purgeable | Medium | Better; still one credential theft from gone |
| Immutable / write-once storage, separate credentials | Yes | Yes - retention lock prevents deletion | Medium | The standard to aim for |
| Offline / air-gapped media, rotated | Yes | Yes - physically unreachable | Slow | Last line of defense; test the media |
Two SCADA-specific additions. First, back up the whole recovery surface: historian data, server and application configuration, screens and tag databases, alarm setpoints, PLC and RTU programs, and gateway configurations. Second, prove restores work. A timed restore drill at least twice a year - restoring to clean hardware, measuring hours-to-operational - is the only evidence that counts. Ask the same of vendors: Merobix validates backup archives and maintains controlled restore tooling as part of the platform, and its ongoing validation program is adding regularly exercised restore and failover drills. Our full SCADA backup and disaster recovery guide covers RPO/RTO targets and retention design.
The window between initial access and encryption - often days or weeks - is your best opportunity. Detection in that window turns a catastrophe into an incident report. Watch for the precursors, not just the ransom note:
Feed OT security events into the same console your IT security team watches, so the OT side stops being a blind spot. Merobix runs runtime threat monitoring that flags repeated authentication failures, privilege probes, cross-tenant denials, and suspicious control activity, and delivers security notifications through a durable outbox to email, SMS, webhooks, and your SIEM - with retry and dead-letter handling so alerts do not silently vanish mid-incident.
When encryption hits, the organizations that recover fastest are the ones that already decided what to do. Your OT ransomware playbook should answer, in writing, before the incident:
Then run a tabletop exercise annually with operations in the room, not just IT - rehearsed, role-assigned response is the core recommendation of NIST SP 800-61 Rev. 3 on incident response. Our OT incident response plan guide provides the full template.
Buyers evaluating cloud SCADA ask a fair question: does moving supervisory software out of the plant help or hurt against ransomware? Honestly assessed, it shifts the risk profile in your favor on several fronts - with responsibilities that remain yours:
The cloud vs on-premise comparison weighs the full trade-off beyond ransomware.
Key takeaway: Ransomware defense in OT is five layers, in priority order: segment IT from OT with no shared domain, remove exposed remote access and enforce MFA everywhere, keep immutable backups you have restore-drilled against the clock, detect precursors while the intrusion is still IT-side, and rehearse a recovery plan that names who isolates, who restores, and in what order. Every layer is buildable with today's tools - and a platform that ships hardened defaults, like Merobix with its outbound-only gateway, MFA, lockout, validated backups, and SIEM-connected threat monitoring, removes the configuration gaps attackers rely on. See the architecture in a guided demo.
In most publicly documented industrial incidents, ransomware enters through the IT side - a phishing email, a stolen credential, or an exposed remote-access service - and then spreads toward OT across flat networks, shared Windows domains, and dual-homed machines. Direct compromise of PLCs is rare; the far more common damage is encryption of Windows-based SCADA servers, engineering workstations, and historians, plus precautionary shutdowns when operators lose visibility. That is why segmentation between IT and OT, elimination of exposed inbound remote access, and multi-factor authentication are the highest-value ransomware defenses for industrial operators.
Mainstream ransomware targets Windows and Linux systems, not PLC firmware, so controllers themselves are rarely encrypted. The practical risk is different: ransomware encrypts the SCADA servers, HMIs, engineering workstations, and historians that operators depend on, leaving the process running blind or forcing a precautionary shutdown. Losing engineering workstations can also mean losing the only copy of PLC programs, which turns recovery from a restore job into a re-engineering project. Back up controller logic and device configurations with the same discipline as server data.
Follow the 3-2-1 pattern: at least three copies of critical data, on two different types of storage, with one copy offline or immutable so ransomware that steals administrator credentials still cannot reach it. For SCADA specifically, that must cover more than the historian database - you need server configurations, screens and tag databases, alarm setpoints, PLC programs, and gateway configurations. Then prove it: a backup that has never been through a timed restore drill is a hope, not a plan. Ask vendors how backup archives are validated and what controlled restore tooling exists.
Cloud SCADA changes the risk profile rather than removing it. On the positive side, a vendor-operated platform is patched continuously, sits outside your Windows domain so it does not encrypt along with your file shares, and an outbound-only gateway removes the exposed inbound remote-access services that ransomware operators exploit. You still own the OT-side risks: engineering workstations, local HMIs, and PLC programs remain your responsibility, and you should verify the vendor's own backup validation, restore tooling, and recovery commitments in writing before you buy.
Standard guidance from CISA and the FBI is to avoid paying: payment funds further attacks, does not guarantee working decryption, and may raise legal issues if the group is sanctioned. Some organizations still pay under extreme operational pressure, which is exactly the position good preparation removes. Tested offline backups, a rehearsed incident-response plan, cyber insurance reviewed in advance, and early engagement with law enforcement give you options other than the ransom note. Decide your policy with legal counsel before an incident, not during one.
Outbound-only gateway, MFA and lockout by default, validated backups with controlled restore tooling, and SIEM-connected threat detection - see how Merobix hardens industrial operations against ransomware.