The Line Stopped and Nobody Touched a PLC
Two manufacturers halted production this summer. Neither attack reached a controller.
A plant with every controller online and no order to build is a plant that is down.
On 10 June, Mackay Sugar stopped milling and cane haulage at two of its three Queensland mills. Five weeks later, Coca-Cola told the SEC that fairlife had suspended all US production. The Canadian plants kept running.
Dragos reviewed the Mackay Sugar incident and found no evidence that the attackers reached ICS or manipulated the process. The mills stopped anyway.
I have spent thirty years around control systems, and those two events break a reflex I used to have myself. If the PLCs are clean, the plant is fine.
What your scope leaves out
You scope OT security to the control network. Levels 0 through 3, the assets with firmware versions and rack slots, the things an OT scan can see. That scope produced the asset inventory on your wall and the budget line you defended last year.
The systems that stopped those two producers sit above it, in territory your OT program excludes and your IT team owns on a ticket queue.
Call it the IT tether. Every enterprise system your line cannot finish a shift without, which nobody has counted and which has no single owner.
Three tethers carry most of the load.
Order. ERP and MES decide what the line makes, in what sequence, against which recipe, and whether the pallet leaves with a label it can ship on. Take them away and the line runs through whatever is staged in front of it, then stops with every controller healthy.
Host. Your historian, your HMI servers and your engineering workstations increasingly run as guests on virtualization a data center team administers. The controller keeps running. The screen your operator drives it from is gone.
Access. Identity is the tether with the least documentation: contractor accounts nobody revoked, and the corporate domain your plant inherited during an integration that nobody has revisited since.
What the second quarter looked like
Dragos counted 1,140 industrial ransomware incidents in the second quarter of 2026, up 12 percent on the first quarter. 747 of them hit manufacturing.
Mackay Sugar is the clean case because the forensics are public. The Gentlemen claimed it. Milling and cane haulage stopped at two of three mills. No ICS access, no process manipulation, no controller logic touched. What the attackers took was the enterprise layer those mills schedule and move cane with.
The Fairlife disclosure is the more expensive version. Coca-Cola’s filing said intruders reached production-related systems and that the company had not yet determined the full scope. US production suspended. Canadian production continued, which tells you the dependency was regional, sitting in something the US plants shared and the Canadian ones did not.
In the plants I have walked, the sequence runs the same way. MES loses ERP. Order release stops. Operators keep building what is already staged, which buys the length of whatever sits in front of them. Then the line runs out of work it is authorized to make, and a plant with every controller online produces nothing.
Why visibility does not answer this
The OT security tools you bought answer one question well: what is on my control network. Ask what stops your line and they go quiet. The answer is not on the network they watch.
Your asset inventory has the same limit. It lists things you own. Production stops come from things you depend on, and those two lists overlap less than the budget assumes.
What the better operators do
They keep a dependency list per line rather than per asset. One line, one page. The enterprise systems that line cannot finish a shift without, each with a named owner and a restoration time somebody has measured with a stopwatch rather than promised in a contract.
It is a short document, and the useful part is the argument it starts. Some of those entries belong to a team that has never been told a production line depends on them.
What you can do this week
If you’re a plant or OT leader: Pick your highest-value line and write down what it cannot finish a shift without. Ask the owner of each entry how long a full restoration takes and whether anyone has timed one.
If you’re a CISO or enterprise risk lead: Take that list to whoever scoped your OT program and mark which entries fall inside the scope. Report the count of entries outside it instead of a maturity score.
If you’re a COO or CFO: Ask for the dependency list before you approve the next OT security capital request. A program scoped to the control network is buying insurance against the smaller of your two exposures.
A final thought
Both of these were IT incidents, and the OT teams involved did nothing wrong. That is accurate, and it restarted nothing. The mills were down, the milk was not made, and the boards asked the question you would expect: why did the plant stop if the plant was secure?
Your turn
Take your highest-value line. Which enterprise system, dark on a Sunday night, stops it before the next shift ends? And can you name the person who owns that system’s recovery time?
This post is part of The IT Tether series. Read every chapter in one place in The IT Tether eBook, or book a demo to see how Resilion maps what stops your line.