When ransomware hit Colonial Pipeline in May 2021, the operators made a decision that stunned the industry: they shut down 5,500 miles of fuel pipeline not because the operational technology was compromised, but because they couldn’t confirm it wasn’t. Six days of disruption. $4.4 million in ransom. Fuel shortages across the eastern United States.
Three years later, that incident remains the most visible example of a shift that was already underway and has since accelerated: ransomware has become an industrial threat.
This is not simply about hackers finding new targets. It is about a structural change in the attack surface that industrial organisations present — and a structural gap between the security posture most organisations have built and the threat they now face.
1. Why Industrial Sectors Have Become Prime Ransomware Targets
For much of the 2010s, industrial organisations were considered low-value targets for ransomware. The technology was specialised, the networks were isolated, and the economics of attacking a refinery or a food processing plant simply didn’t work for most threat actors.
That calculus has changed. Three factors have converged to make industrial environments not just accessible but highly attractive:
IT/OT convergence has dissolved the isolation that once protected industrial networks. Remote monitoring, cloud-based analytics, and Industry 4.0 connectivity initiatives have bridged gaps that previously kept OT environments separate from enterprise IT — and from the internet.
Operational pressure makes payment more likely. A law firm hit by ransomware loses data. A refinery hit by ransomware loses production — potentially millions of dollars per day. The pressure to pay and restore operations quickly is significantly higher in industrial environments.
OT environments are harder to recover. Unlike IT systems, where backups and restore procedures are well-established, OT recovery involves re-commissioning specialised hardware, revalidating safety systems, and restoring historian data. Documented average recovery times for industrial ransomware incidents range from 17 to 21 days.
2. The Threat Landscape in 2024: What the Data Shows
Dragos’s 2024 OT Cybersecurity Report documented 905 ransomware attacks on industrial organisations — a 50% increase over the prior year.
Manufacturing accounted for the largest share, overtaking energy as the most targeted sector. Oil & gas, utilities, and food and beverage followed.
Within Nigeria and West Africa, the threat is both global and local. Nigerian oil and gas operations are integrated into international supply chains and operate infrastructure that is commercially and strategically significant. Manufacturing facilities are increasingly connected to regional and global logistics networks. The same vulnerabilities that have been exploited in Europe and North America exist here — and in many cases are more acute, given legacy infrastructure and resource constraints on security investment.
3. Anatomy of an Industrial Ransomware Incident
Understanding how industrial ransomware attacks actually unfold is essential for appreciating why conventional IT security approaches are insufficient.
Initial access rarely involves a direct attack on OT systems. Most intrusions begin in the enterprise IT environment — through phishing emails, compromised credentials, or vulnerable remote access infrastructure. The Colonial Pipeline breach began with a compromised VPN password.
Dwell time is measured in weeks, not hours. Once inside an enterprise network, sophisticated threat actors spend time mapping the environment, identifying high-value systems, and positioning for maximum impact before deploying ransomware. Average dwell time in industrial incidents is 24 days.
The pivot to OT is deliberate. Modern ransomware groups have developed capabilities to identify and target industrial control systems. Some variants specifically search for historian servers, engineering workstations, and HMI systems — the systems whose loss causes operational disruption, not just data loss.
Encryption is the last step. By the time ransomware deploys, the attacker has already achieved persistence, exfiltrated data, and positioned for maximum impact. The encryption event is the trigger for operational disruption — and for the ransom demand.
4. The Real Cost of an Industrial Ransomware Incident
The ransom itself is rarely the most significant cost. A 2024 analysis of industrial ransomware incidents found the following cost components:
Operational downtime: For oil and gas operators at capacity, $1–3 million per day.
For manufacturers, the cost depends on product value, customer commitments, and contractual penalties — but even mid-scale operations face six-figure daily exposure.
Recovery and remediation: Re-commissioning OT systems, restoring data, and rebuilding security architecture typically costs significantly more than the ransom payment itself.
Regulatory and compliance costs: In sectors subject to HSE reporting requirements or data protection obligations, incidents can trigger mandatory notifications, investigations, and potential penalties.
Reputational and commercial impact: Supply chain partners, investors, and insurers respond to industrial cyber incidents. The long-term commercial consequences — lost contracts, increased insurance premiums, reduced credit terms — are rarely captured in incident cost analyses.
5. Why Air Gaps Are No Longer a Security Strategy
The assumption that physical isolation protects industrial networks — the “air gap” concept — has become increasingly unreliable. Stuxnet was delivered to an air-gapped facility via infected USB drives. Contractors routinely connect laptops to OT networks for maintenance. The growth of remote monitoring has created new IT/OT bridges — often without the same security rigour applied to enterprise network connections. An air gap may reduce attack surface. It is not a security programme.
6. The Specific Vulnerabilities of Nigerian Industrial Environments
Industrial operators in Nigeria face several factors that shape their threat exposure: legacy infrastructure running end-of-life OT platforms; skilled security resource constraints in an environment of global OT specialist shortages; NUPRC’s emerging cybersecurity guidelines creating compliance requirements many operators are not yet positioned to meet; and supply chain exposure through oilfield service companies, technology vendors, and logistics partners connected to Nigerian operations.
7. What Effective OT Cybersecurity Looks Like
Asset visibility: A complete and current inventory of OT assets — every controller, every HMI, every historian, every network connection. Most industrial organisations lack this.
Network segmentation: IT and OT networks segmented, with controlled and monitored traffic flows between them. The Purdue Model and IEC 62443 provide frameworks for industrial network architecture that limits the blast radius of an intrusion.
Continuous monitoring: OT-specific network monitoring tools — from vendors such as Dragos, Claroty, and Nozomi — provide the visibility needed to detect anomalous behaviour before it escalates to a ransomware event.
Vulnerability management: A risk-based approach that accounts for asset criticality, patch availability, and the operational impact of patching.
Incident response planning: An OT-specific incident response plan tested through tabletop exercises with operations leadership, not just IT.
Third-party risk management: Vendor access controlled, monitored, and time-limited. Remote access solutions designed for OT, not adapted from IT VPN tools.
8. The Regulatory Dimension
Industrial operators in Nigeria’s oil and gas sector face an evolving regulatory landscape. NUPRC has issued cybersecurity guidance applicable to upstream operators, and the broader direction of regulation — both domestically and internationally — is toward mandatory minimum standards for OT security. Compliance with these requirements is not the same as security. Organisations that approach OT cybersecurity as a compliance exercise often build documentation of security without the substance.
9. Building the Business Case for OT Security Investment
The most effective framing is not “what is the probability of an attack?” but “what is our maximum credible loss in a ransomware incident, and how does the cost of prevention compare to the cost of response?” For a Nigerian upstream operator with $2 million per day production exposure, three weeks of downtime represents $42 million in lost revenue — before remediation, regulatory, and reputational costs. An OT security programme that materially reduces that risk profile is not a cost centre. It is an investment in operational continuity.
10. Where to Start
For industrial leaders who are beginning to engage seriously with OT cybersecurity, the starting point is always the same: understand your current exposure. That means knowing what OT assets you have, how they are connected, what vulnerabilities exist, and what your recovery capability looks like today. An OT/ICS cybersecurity assessment is not a threat. It is the information needed to make risk-informed decisions about where to invest, what to prioritise, and what the organisation’s actual exposure looks like.
