INDUSTRY FACT FILE · MANUFACTURING & INDUSTRIAL PRODUCTION

Five New Case Studies in Manufacturing Security

Original 2026 case studies, each written as a blog post, showing how current threats play out in engineering, machinery, electronics and industrial equipment companies and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Supplier That Stopped Fourteen Lines 3.  Case Study 2: The ERP That Ran the Plant 4.  Case Study 3: The Maintenance Tunnel Nobody Closed 5.  Case Study 4: The Drawings That Walked Out 6.  Case Study 5: The Smart Factory Pilot That Opened the Door

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining attack techniques and control failures widely observed in manufacturing with the obligations that apply in India as of October 2026—in particular CERT-In's Directions and audit guidelines, SEBI disclosure for listed companies, DPDP and the customer and export requirements that reach Indian plants.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Organisation type	Core threat	Regulatory lens	Primary bundles
1. The Supplier That Stopped Fourteen Lines	Tier-2 component supplier and its OEM customer	Supplier ransomware breaking just-in-time supply	CERT-In; customer contracts; SEBI (OEM)	B9, B10, B7
2. The ERP That Ran the Plant	Industrial machinery manufacturer	Ransomware encrypting ERP and MES	CERT-In; SEBI LODR; insurers	B3, B7, B8
3. The Maintenance Tunnel Nobody Closed	Electrical equipment manufacturer	Abuse of an automation OEM's remote access	CERT-In; IEC 62443; OEM contract	B9, B1, B7
4. The Drawings That Walked Out	Capital goods and engineering company	Insider theft of design data	DPDP; contracts; forensics	B3, B7, B8
5. The Smart Factory Pilot That Opened the Door	Electronics manufacturer with an Industry 4.0 programme	Internet-exposed IIoT gateway bridging to OT	CERT-In; IEC 62443; customer contracts	B11, B3, B1

The OEM's systems were untouched. Its lines stopped anyway.

At a glance
Organisation	A precision-component supplier (“Partco A”) feeding an assembler (“OEM A”) on a just-in-time schedule
Threat	Ransomware encrypting the supplier's ERP, EDI and shipping systems
Why it is new	In a lean supply chain, a supplier's incident is the customer's outage
Codec Networks services	Supplier cyber risk programme, joint exercises, SOC (Bundles B9, B10, B7)

The scenario

Ransomware encrypted Partco A's ERP, EDI gateway and shipping systems overnight. Its machines could run, but it could not receive OEM A's call-offs, print labels or confirm dispatches.

OEM A held less than a shift of Partco A's parts. By the afternoon, fourteen assembly lines across two plants had stopped for want of one component.

OEM A had never assessed Partco A's security, its contract contained no incident-notification clause, and no alternate source was qualified. Lines restarted only when Partco A rebuilt enough systems to ship manually.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• Critical suppliers had never been assessed for cyber risk.
• Contracts were silent on security and incident notification.
• No buffer or alternate source for a single-source part.
• Partco A had no tested backups and no manual-dispatch plan.

The impact

OEM A lost two days of output, incurred delivery penalties with its own customers and, as a listed company, disclosed the incident. Partco A faced recovery costs and a review of its contract.

The regulatory lens

• CERT-In Directions: Partco A reported the incident within six hours.
• SEBI LODR: OEM A disclosed the incident in its quarterly corporate governance report.
• Customer contracts: OEM A's customers invoked delivery penalties; Partco A's contract was renegotiated with security clauses.

How Codec Networks would help

Need	Codec Networks response	Bundle
Know your critical suppliers	Supplier cyber risk programme: tiering, assessments, contract clauses	B9
Rehearse the outage	Joint supplier incident exercises and buffer planning	B10
Detect early on both sides	SOC with EDR for the supplier; alerting on EDI anomalies for the OEM	B7

Key lessons Assess the suppliers that can stop your lines. Put security and notification in contracts. Hold buffers or alternates for single-source parts. Exercise supplier outages together.

Every machine on the floor worked. Nothing left the gate for three weeks.

At a glance
Organisation	A listed machinery manufacturer (“Machco B”) with three plants on one ERP and MES
Threat	Phishing leading to domain compromise and ransomware across ERP, MES and file servers
Why it is new	Plants stop when the systems that schedule and ship stop
Codec Networks services	Segmentation and backups, SOC, forensics (Bundles B3, B7, B8)

The scenario

A phishing email gave attackers a foothold in Machco B's IT network. Over two weeks they escalated to domain administrator unnoticed—EDR alerts were raised but nobody watched them at night.

On a Sunday, ransomware encrypted ERP, MES, file servers and the backup server, which sat on the same network with domain credentials.

The PLCs and CNC machines were untouched, but without MES work orders, ERP picking lists and labels, the plants ran on paper at a fraction of capacity for three weeks while systems were rebuilt.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• Backups were online and domain-joined, so they were encrypted too.
• The plant depended on IT with no manual-operation plan.
• EDR alerts were not monitored 24x7.
• No tested restart sequence for MES and ERP.

The impact

Machco B lost three weeks of normal output, missed deliveries, paid recovery costs, disclosed the incident under SEBI LODR and faced insurer questions about backup warranties.

The regulatory lens

• CERT-In Directions: incident reported within six hours; logs needed for investigation.
• SEBI LODR: cyber incident disclosed in the quarterly corporate governance report.
• Insurers: policy conditions on backups and MFA scrutinised.

How Codec Networks would help

Need	Codec Networks response	Bundle
Separate and recover	IT/OT segmentation, immutable backups, tested ERP and MES restores	B3
Detect early	24x7 SOC with EDR monitoring and threat hunting	B7
Investigate and report	Forensics, root cause, CERT-In and disclosure support	B8

Key lessons Keep backups immutable and off the domain. Plan and rehearse running the plant without IT. Monitor EDR around the clock. Test ERP and MES restores regularly.

The attackers never touched the office network. They came in through the vendor.

At a glance
Organisation	A switchgear manufacturer (“Elecco C”) with automated assembly and test lines
Threat	Phished OEM engineer account used through a standing VPN to reach PLC engineering software
Why it is new	Vendor remote access is the most common unmonitored path into plant networks
Codec Networks services	Vendor access programme, OT assessment, OT monitoring (Bundles B9, B1, B7)

The scenario

Elecco C's automation OEM maintained a permanent VPN into the plant network for support, using an account shared by several of the OEM's engineers.

One engineer was phished. Attackers used the VPN, found the PLC engineering workstation and altered set-points on a test line, causing a batch of switchgear to be marked as passed when it had not been tested correctly.

The error surfaced only when a customer rejected the batch. Investigation found months of remote sessions with no record of who connected or what changed.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• Standing VPN with a shared vendor account and no MFA.
• No record of remote sessions or PLC changes.
• Engineering workstation reachable directly from the VPN.
• No OT monitoring of engineering activity.

The impact

Elecco C recalled a batch, lost a customer order, reported the incident and re-tendered its OEM support contract with security requirements.

The regulatory lens

• CERT-In Directions: incident reported within six hours.
• IEC 62443: zone-and-conduit and remote access requirements that the plant did not meet.
• OEM contract: no security obligations on the vendor's access.

How Codec Networks would help

Need	Codec Networks response	Bundle
Control vendor access	Brokered, time-bound access with MFA and recording; vendor assessment	B9
Verify the plant	OT assessment of PLC change control and engineering workstations	B1
Watch engineering activity	OT monitoring of remote sessions and PLC changes	B7

Key lessons Replace standing VPNs with brokered access. Give every vendor engineer a named account with MFA. Record remote sessions and PLC changes. Put security into OEM support contracts.

No malware, no ransom—just a competitor's product that looked very familiar.

At a glance
Organisation	A capital-goods manufacturer (“Engco D”) with proprietary designs and process recipes
Threat	A departing design engineer copying CAD files, BOMs and recipes to personal cloud storage
Why it is new	Designs are a manufacturer's most valuable and least monitored asset
Codec Networks services	DLP and PLM access review, activity monitoring, forensics (Bundles B3, B7, B8)

The scenario

A senior design engineer accepted an offer from a competitor and, over six weeks, exported CAD models, bills of material, process recipes and a customer price list from PLM and file shares to a personal cloud account.

PLM allowed bulk export to anyone in the engineering group, uploads to personal cloud were not blocked or monitored, and the leaver's access remained active for a week after departure.

Months later a rival product with near-identical features appeared at a trade fair, and a customer mentioned being approached with Engco D's own pricing.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• Design data was not classified or access-restricted by need.
• Bulk export and personal cloud uploads were not controlled or monitored.
• Leaver procedures did not remove access on the last day.
• No forensic readiness to prove what was taken.

The impact

Engco D lost bids, launched legal action with limited evidence, notified affected customers and rebuilt its design-data governance.

The regulatory lens

• Contracts and IP law: confidentiality obligations and the need for evidence.
• DPDP: customer and employee personal data in the exported files.
• Customer obligations: notification where customer drawings were involved.

How Codec Networks would help

Need	Codec Networks response	Bundle
Protect the crown jewels	Data classification, DLP, PLM access reviews and least privilege	B3
See it happening	User and cloud activity monitoring with alerts on bulk export	B7
Prove it	Forensic readiness and investigation support for legal action	B8

Key lessons Classify and restrict design data. Block and monitor personal cloud uploads. Remove leaver access on day one. Be ready to investigate and prove.

The energy dashboard worked beautifully. So did the attackers' route to the HMIs.

At a glance
Organisation	An electronics manufacturer (“Emsco E”) piloting IIoT energy monitoring on an SMT line
Threat	Compromised edge gateway with default credentials used to move laterally to HMIs
Why it is new	Industry 4.0 projects create new bridges between the internet and the plant
Codec Networks services	IIoT assessment, segmentation, OT assessment (Bundles B11, B3, B1)

The scenario

Emsco E installed IIoT sensors and an edge gateway to feed a vendor's cloud energy dashboard. The gateway was placed on the plant network for convenience and exposed to the internet for the vendor's access.

The gateway kept its default administrator password. Automated scanning found it, attackers compromised it and used it to reach HMIs and the MES server on the same network.

Production stopped for two days while the plant network was rebuilt, and a global customer demanded an independent assessment before resuming orders.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• No security assessment of the IIoT project before go-live.
• Gateway on the plant network, not in a segmented zone.
• Default credentials and internet exposure.
• No OT asset discovery or monitoring to spot the new device or the lateral movement.

The impact

Emsco E lost two days of output, reported the incident, funded an independent assessment for its customer and re-architected its Industry 4.0 programme.

The regulatory lens

• CERT-In Directions: incident reported within six hours.
• IEC 62443: IIoT devices belong in their own zone behind a DMZ.
• Customer contracts: the OEM customer required an independent assessment and evidence.

How Codec Networks would help

Need	Codec Networks response	Bundle
Assess before go-live	IIoT and edge security assessment, device and firmware hardening	B11
Isolate	Segmented IIoT zone and DMZ design, no direct internet exposure	B3
Verify the plant	OT assessment with continuous asset discovery and monitoring	B1

Key lessons Assess every Industry 4.0 project before it goes live. Put IIoT in its own zone behind a DMZ. Change default credentials and manage firmware. Discover and monitor every device on the plant network.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com