The famous attacks are the ones you can name. They are not the number.

Every industrial cybersecurity presentation opens with the same timeline. Maroochy Shire in 2000. Stuxnet in 2010. The German steel mill in 2014. The Ukrainian grid in 2015 and 2016. TRITON in 2017. Colonial Pipeline in 2021. A handful more, up to the present year.

As a teaching tool the timeline works. Each of those incidents shows something specific: that a controller can be made to damage physical equipment, that a safety instrumented system can be targeted, that a grid can be switched off by hand from a stolen session. They have earned their place in the slide deck.

The trouble starts when the same slide is used to answer a different question, how often does this happen? For that question it is misleading, and the gap is easy to state: roughly one famous incident a year, against 3,300 industrial organisations hit by ransomware in 2025 alone.

What the counts actually say

Those two dozen named incidents span twenty-five years. Here is a single year, as Dragos reports it in its 2026 OT Cybersecurity Year in Review, published in February 2026:

• 3,300 industrial organisations were affected by ransomware in 2025.
• Ransomware attacks on industrial organisations were up 64% year on year.
• Dragos tracked 119 ransomware groups targeting industrial organisations, against 80 the year before, a 49% rise in the number of distinct groups.
• Manufacturing accounted for more than two-thirds of victims.

IBM’s 2026 X-Force Threat Intelligence Index arrives at the same place from a different dataset. Manufacturing was the most attacked industry for the fifth year running, at 27.7% of incidents among the top industries. Attacks that began by exploiting a public-facing application rose 44%, and large supply chain and third-party compromises have nearly quadrupled since 2020.

The famous timeline is not a sample of that population. It is the short list of incidents spectacular enough to get a name.

The counterpoint

One figure runs the other way, and an honest analysis has to include it.

The Waterfall Security and ICS STRIVE 2026 OT Cyber Threat Report counts only attacks with physical consequences: a process stopped, equipment damaged, a service interrupted. That count fell 25% in 2025, to 57 incidents against 76 in 2024.

The two findings measure different things, so they do not contradict each other. Business disruption of industrial companies rose sharply, while the incidents that reached the process and produced a physical effect dipped. Most of the dip comes from fewer ransomware incidents with physical impact, and the authors treat it as temporary rather than as a sign that defences have improved. Over the same period, incidents attributed to nation-states and hacktivists doubled, although from a small base.

The accurate summary is narrower than “everything is getting worse” and more useful. The number of industrial companies being disrupted is rising steeply. So is the number of attackers able to reach OT. The subset that reaches the physical process moved with the ransomware economy, not with anyone’s defences.

Why the famous list under-counts so badly

An incident has to pass four filters to earn a place on that timeline, and each filter throws away far more than it keeps.

First, it has to be disclosed. Most are not, or they are disclosed as “an IT incident” with no word about production. A plant that lost four days of output because ransomware took down the MES appears in no timeline.

Second, it has to be interesting. The tenth water utility compromised through an internet-exposed PLC with a default password is not news, but it is still a compromised water utility.

Third, someone has to find the cause. Unexplained stoppages get written up as equipment faults, and without OT monitoring there is nothing to contradict the maintenance report.

Fourth, it has to be detected at all. Dragos puts the industry-wide average dwell time for ransomware in OT environments at 42 days, and 5 days for organisations with comprehensive OT visibility. Read that gap as a rough measure of how much goes unseen.

What this changes for a plant

If your reference points are Stuxnet and TRITON, the natural internal conclusion is that will not happen to us, and it is probably right. Those were state-level operations against chosen targets.

The problem is that the conclusion then gets applied to the wrong question. The realistic scenario for a mid-sized industrial site is commodity ransomware arriving through a vendor account, an exposed remote-access service or an unpatched public-facing application. It encrypts the MES and the historian, and the line stops because it cannot run without them, even though nobody touched a single PLC.

That scenario sits inside the 3,300. It is the base rate. Planning against the headline cases while living in the base rate is the strategic error we meet most often on site.

What actually moves the number

None of this is exotic, and each item ties back to the figures above.

Visibility in OT comes first. The gap between 42 days and 5 days is the largest documented difference between organisations, and it comes from knowing what normally talks to what, more than from a new firewall.

Remote access is next. Vendor and contractor access is one of the most consistent ways into industrial environments, so accounts should be named, time-bounded, brokered and logged.

Then the internet-facing edge. With exploitation of public-facing applications up 44% in a year, anything of yours that answers from the internet belongs in the inventory and needs an owner.

The supply chain follows the same logic. Your integrator’s laptop is part of your attack surface whether or not it appears on your network diagram.

Finally, a restore you have actually performed: timed, on the real system, with the result written down. A backup that has never been restored is an assumption.

The timeline shows what is possible. The counts show what is likely. Build the plan on the first alone and you will be well prepared for the wrong event.

References

• Dragos, 2026 OT Cybersecurity Year in Review and its press release of 17 February 2026: 3,300 organisations, +64%, 119 groups, 42 and 5 days.
• IBM, X-Force Threat Intelligence Index 2026: manufacturing most attacked for the fifth year, 27.7% of incidents.
• Waterfall Security and ICS STRIVE, 2026 OT Cyber Threat Report, 18 February 2026: 57 attacks with physical consequences in 2025, down from 76.