INDUSTRY FACT FILE · METALS, MINING & CEMENT

Threat Landscape: Top Cyber Threats Facing Metals, Mining and Cement

The 18 most relevant cyber threats, attacks and industry challenges for mining groups, steel and aluminium producers, smelters, foundries and cement manufacturers, and the impact each one has on sites, safety, revenue and buyers.

Metals, mining and cement companies attract ransomware groups because every hour of stopped dispatch or production is measured in lost tonnes and contractual penalties, which makes victims more likely to pay; they attract fraudsters because dispatch, royalty and procurement flows move large sums through many hands; and they attract state actors because coal, steel and critical minerals are strategic. The attack surface is unusually wide and remote: DCS and PLCs that cannot be patched, remote operations centres linked across sites, weighbridges and e-permit portals, captive power plants, and OEMs, MDOs and contractors connected from outside.

Public incidents show the pattern. Norsk Hydro ran aluminium plants on manual procedures for weeks after LockerGoga ransomware in 2019, estimating the first-half cost at NOK 550–650 million; Nucor temporarily halted certain production operations at various locations after unauthorised access to its IT systems in May 2025; Evolution Mining disclosed ransomware in August 2024; and Northern Minerals saw stolen data published by the BianLian group after refusing to pay. Globally, IBM X-Force ranks manufacturing the most attacked industry for the fifth consecutive year and Dragos reports that manufacturers were more than half of industrial ransomware victims in 2024. Indian producers share the same technology, the same vendors and the same exposure.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by metals, mining and cement segment (Codec Networks assessment).

4.1 Ransomware and the dispatch dependency

Attackers rarely need to touch a DCS to stop a producer. Encrypting ERP, dispatch and weighbridge servers removes the ability to issue permits, gate passes and invoices; kilns and furnaces keep producing into full silos and yards until they are cut back, as Norsk Hydro and Nucor's experiences illustrate.

• Questions to test: Which dispatch, permit and billing processes depend on ERP and weighbridge systems? Can we dispatch manually and lawfully for a week? Are backups immutable and restores tested? Would EDR and the SOC catch the intrusion before encryption?
• Relevant services: dependency mapping, segmentation, backup and recovery testing, EDR validation, crisis exercises.

4.2 Remote operations, fleets and contractors

Remote operations centres concentrate control of fleets, drills and dispatch across sites and connect MDOs, OEMs and contractors through site links that were built for availability, not security. A shared or phished contractor account becomes a path to fleet and dispatch servers.

• Questions to test: Which contractors and OEMs can reach our remote-ops and fleet systems? Are accounts named, MFA-protected and time-bound? Are site links segmented and monitored? Do contracts require security and notification?
• Relevant services: remote-ops architecture review, fleet system testing, brokered access, supply chain assessments.

4.3 Vendor devices and furnace automation

Furnace, kiln and mill automation is maintained by OEM engineers who bring laptops and media from other customer sites, often connecting directly to Level 2 networks during shutdowns and turnarounds. Malware on one laptop can spread across HMIs and engineering stations.

• Questions to test: Do we check and control vendor devices before connection? Is furnace automation segmented into zones with conduits? Do we monitor engineering activity and configuration changes? Is there a clean restart procedure for HMIs?
• Relevant services: vendor device controls, zone-and-conduit design, OT monitoring, change control, vendor recertification.

4.4 Dispatch, permit and compliance data integrity

Weights, e-permit quantities, royalty returns and emissions readings are statutory data. Excessive privileges, missing audit trails and unreviewed edits enable diversion fraud and expose producers to penalties and disputes with state departments, regulators and EU buyers.

• Questions to test: Who can edit weighbridge, permit or emissions data after the fact? Are logs tamper-evident and reconciled? Do analytics flag anomalies? Could we reconstruct records for an audit or dispute?
• Relevant services: dispatch system testing, segregation of duties, integrity logging, analytics, forensic readiness.

4.5 Captive power, safety and the 6-hour clock

Captive power plants and safety systems are frequently reachable from corporate IT, and remote sites are rarely monitored. An intrusion that trips power to a potline or alters gas monitoring is a safety event and a CERT-In report within six hours, with SEBI disclosure for listed companies.

• Questions to test: Are captive power DCS and safety PLCs segmented from corporate IT? Are plant and mine networks monitored 24x7? Is there a playbook covering containment, safe operation, DGMS and CERT-In reporting and disclosure?
• Relevant services: utility OT assessment, safety system reviews, IT/OT SOC, playbooks, joint drills.

• CERT-In: incidents reported within six hours of noticing them; logs available for investigation.
• SEBI LODR: listed producers disclose cyber incidents and data loss in the quarterly corporate governance report.
• NCIIPC: incidents affecting notified protected systems require coordination, which can include public-sector coal, steel and mineral undertakings.
• DGMS and state departments: incidents that affect safety systems, mine records or statutory dispatch data engage mine safety and royalty obligations.
• DPDP: incidents involving employee, contractor or dealer personal data trigger breach intimation once provisions commence in May 2027.
• Buyers, lenders and insurers: contracts require incident notification; EU importers need reliable CBAM data; insurers require evidence that warranted controls were in place.

• If ERP and dispatch went dark tonight, could trucks and rakes leave tomorrow—and lawfully?
• Which contractor, OEM or MDO could reach our fleet, DCS or remote operations, and is every session recorded?
• Could anyone alter weights, permits or emissions data without a reconciled, tamper-evident log?
• Is our captive power plant separated from corporate IT, and have we tested the boundary?
• Do we have offline backups of DCS, fleet and dispatch configurations and a tested restart plan?
• Could we detect, contain and report an incident within six hours while keeping every site safe?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific organisation. Public incident references are summarised from widely reported events and company disclosures.