INDUSTRY FACT FILE · TEXTILES, APPAREL & CONSUMER MANUFACTURING

Threat Landscape: Top Cyber Threats Facing Textiles, Apparel and Consumer Manufacturing

The 18 most relevant cyber threats, attacks and industry challenges for mills, exporters, footwear and consumer goods manufacturers, brand owners and D2C arms, and the impact each one has on shipments, designs, payments and consumers.

Textile, apparel and consumer manufacturers attract ransomware groups because a stopped shipment in season is expensive and visible; they attract fraudsters because export proceeds, supplier advances and buyer remittances move by email instruction across time zones; they attract competitors because designs, tech packs, lasts and costings are easy to copy and hard to protect; and brands and D2C arms attract credential-stuffing and skimming crews because they hold consumer accounts, loyalty value and card data. The attack surface spans flat plant networks, cloud ERP and PLM, buyer portals, email and consumer platforms built from third-party scripts.

Public incidents show the pattern. VF Corporation's December 2023 incident disrupted order fulfilment and exposed data on about 35.5 million consumers; Hanesbrands' May 2022 ransomware attack limited order fulfilment for about three weeks and cost roughly US$100 million in net sales; Levi Strauss notified 72,231 customers after a June 2024 credential-stuffing attack; and Adidas disclosed in May 2025 that consumer contact data had been taken from a third-party customer service provider. IBM X-Force ranks manufacturing the most attacked industry for the fifth consecutive year. Indian exporters, manufacturers and brands run the same platforms and face the same adversaries.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by textiles, apparel and consumer manufacturing segment (Codec Networks assessment).

4.1 Ransomware and the shipment calendar

Attackers rarely need to touch a sewing line to stop an exporter. Encrypting ERP, the cutting-room system and export documents removes the ability to plan, pack, invoice and clear goods; the vessel sails without the order, as Hanesbrands' three-week fulfilment disruption and VF Corp's replenishment delays illustrate.

• Questions to test: Which packing, invoicing, e-invoicing and customs processes depend on ERP? Can we ship manually and lawfully for a week? Are backups immutable and restores tested? Would EDR and the SOC catch the intrusion before encryption?
• Relevant services: dependency mapping, segmentation, backup and recovery testing, EDR validation, crisis exercises.

4.2 Business email compromise and export proceeds

Export trade runs on email: purchase orders, approvals, invoices and bank details. Attackers who read a merchandiser's mailbox learn the payment cycle and insert new bank details from a look-alike domain at the right moment; losses are rarely recovered and disputes damage buyer relationships.

• Questions to test: Is MFA enforced on every mailbox? Do buyers and suppliers verify bank-detail changes by an agreed second channel? Do we monitor look-alike domains and mailbox rules? Have finance and merchandising been tested with simulations?
• Relevant services: mailbox hardening, verification procedures, look-alike domain monitoring, BEC simulation, SOC.

4.3 Designs, tech packs and contractors

A season's value sits in tech packs, lasts, patterns and costings shared with designers, contractors and buyers in cloud folders. Access is rarely reviewed, downloads are not monitored and contractor accounts outlive projects—so copies appear on marketplaces before launch.

• Questions to test: Is design data classified and access-restricted by need? Are contractor and leaver accounts removed on the last day? Are bulk downloads monitored? Could we prove what was taken?
• Relevant services: data classification, DLP, access and contractor reviews, activity monitoring, forensic readiness.

4.4 D2C platforms, credential stuffing and skimming

Brand sites and apps hold consumer accounts, loyalty value and card data, and are built from SaaS and third-party scripts owned by marketing. Credential stuffing takes over accounts, skimming scripts steal cards at checkout and sale events amplify both—Levi's 72,231 affected accounts show the scale.

• Questions to test: Are sites, APIs and apps tested before launch and each release? Are bot management, rate limiting and MFA in place? Are third-party scripts controlled and checkout PCI DSS-aligned? Does the SOC see account takeover patterns?
• Relevant services: web, API and mobile testing, bot controls, script integrity, PCI DSS readiness, SOC fraud detection.

4.5 Suppliers, service providers and the 6-hour clock

Job-workers, trim suppliers, logistics partners and customer service providers hold your production and your data; their incidents become yours, as Adidas' provider breach shows. Few manufacturers monitor beyond the office, so incidents are found late and reported late against CERT-In's six-hour expectation.

• Questions to test: Which suppliers and providers could stop deliveries or leak consumer data? Have they been assessed and contracted for security and notification? Are units, cloud and e-commerce monitored 24x7? Is there a playbook covering CERT-In reporting, buyer notification and disclosure?
• Relevant services: supplier assurance programme, contract clauses, SOC, playbooks, joint exercises.

• CERT-In: incidents reported within six hours of noticing them; logs available for investigation.
• SEBI LODR: listed companies disclose cyber incidents and data loss in the quarterly corporate governance report.
• DPDP: incidents involving consumer, loyalty, employee or worker personal data trigger breach intimation once provisions commence in May 2027.
• Buyers: vendor contracts require incident notification and can suspend programmes pending independent assessment.
• PCI DSS and payment partners: card data incidents trigger forensic investigation and acquirer obligations.
• EU CRA: manufacturers of connected consumer products sold in the EU report actively exploited vulnerabilities and severe incidents from September 2026.

• If ERP went dark tonight, would this week's shipment sail—and lawfully?
• Could a convincing email move our export proceeds or a supplier advance?
• Who can still download our designs, and would we know?
• Could our D2C site survive a sale-day credential-stuffing and skimming attack?
• Which job-worker or service provider could stop our deliveries or leak our consumers' data?
• Could we detect, contain and report an incident within six hours and tell our buyers what happened?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific organisation. Public incident references are summarised from widely reported events and company disclosures.