Ransomware Just Reached the Plant Floor. Can Your ERP Recover?

Two Attacks, One Lesson

In the space of four weeks, two ransomware attacks stopped physical operations in the United States.

On May 7, Colonial Pipeline shut down its 5,500-mile fuel pipeline after an attack on its business systems, and gas stations across the Southeast ran dry within days. The company paid a ransom of roughly $4.4 million. Then JBS, the world's largest meat processor, halted beef processing at its US plants after an attack on its systems, and later disclosed it had paid $11 million.

What should get a manufacturer's attention is not the ransom amounts.

What should get a manufacturer's attention is not the ransom amounts. It is where the attacks landed. Colonial said it shut the pipeline as a precaution to contain an attack on its IT systems; people briefed on the matter told CNN its billing system had been hit. The pumps worked. The pipe was intact. The business could not run without the systems that tracked what moved and who owed what. That is exactly the position a plant is in when its ERP goes dark.

Your Machines Can Run. Can Your Plant?

Most manufacturers think of operational risk in terms of equipment. A spindle fails, a press goes down, a line stops. Those risks are well understood and usually well planned for.

Far fewer have asked what happens when the machines are fine and the ERP is not. No work orders, no material availability, no shipping documents, no labels, no inventory positions, no customer order status. Receiving cannot receive against a purchase order that cannot be looked up. Shipping cannot ship without a packing list. Within a day, most plants either stop or start running on paper and memory, and the data created in those days has to be reconciled later by hand.

The first step is simply to ask the question out loud: if the ERP were unavailable for a week starting tomorrow morning, what would each department do at 7 a.m.? If nobody can answer, that is the finding.

Backups You Have Never Restored Are a Hope

Almost every company has backups. Far fewer have restored the ERP from them, end to end, into a working environment, and timed how long it took.

Ransomware has changed what a backup has to survive. Modern attacks deliberately look for backup systems and encrypt or delete them first, because a victim with clean backups does not pay. A backup that sits on the same network, uses the same credentials and is reachable from the same compromised administrator account is not a recovery plan. At least one copy needs to be offline or immutable, meaning it cannot be altered or deleted for a set period even by an administrator.

Then test it. Restore the ERP database and application into an isolated environment, bring it up, log in, and run a few real transactions. Write down how long it took and what broke. That number, the hours from decision to a working system, is your real recovery time, and it is almost always longer than the one in the disaster recovery document.

Separate the Office From the Floor

The second structural question is how connected your business network is to your plant floor. In many small and mid-market plants, the machine controllers, the HMIs, the ERP and the email server all sit on one flat network, because that was the easiest way to set it up. That convenience means an infection that starts with an email attachment can reach the equipment.

Segmentation is not glamorous work. It means putting the plant floor on its own network, controlling exactly what crosses between office and floor, and requiring multi-factor authentication for anyone connecting remotely, especially vendors with support access to production systems. Remote access with a shared password is one of the most common ways in, and it is cheap to close.

Write the Manual Procedures Before You Need Them

The plants that recover fastest from an outage of any kind are the ones that decided in advance how they would operate without the system. Printed copies of open work orders and pick lists, refreshed regularly. A paper receiving log. A known way to produce shipping documents. A list of who to call and in what order. A plan for re-entering the transactions made during the outage once the system returns.

None of this requires a large budget. It requires an afternoon with each department lead and the willingness to treat the ERP as critical infrastructure rather than as an office application.

The Bottom Line

Colonial and JBS showed that an attack on business systems can stop physical operations as completely as a mechanical failure. For a manufacturer, the ERP is the system that attack will reach. The defense is a set of unglamorous habits: offline or immutable backups, a timed and tested restore, a plant floor that is separated from the office network, multi-factor authentication on remote access, and manual procedures written before they are needed.

At Cherry Street, this is the work we do. We help manufacturers find out how long their ERP would really take to come back, close the gaps between the office network and the floor, and write the operating plan for the week nobody wants to have.