On 1 November 2026, the Seoul Economic Daily published a count by Korean security firm ESTsecurity: up to 28 October, ransomware groups had posted 23 claims of attacks on South Korean manufacturers on their data-leak sites this year. Ten of them came between July and October, almost as many as in the whole first half. In the second half, the claims increasingly included leaked drawings, source code and databases linked to design and production.
The cases are claims made by criminals, not confirmed incidents, and most of the companies were not named. But the pattern is clear and it is not limited to Korea. Two of the companies make aerospace parts, and one group said it had taken 1 TB of data from a Boeing supplier's product data management (PDM) server. In the United States, a group calling itself Redact claimed on 16 October 2026 to have taken about 10.9 TB from motion and control maker Parker-Hannifin, which has not publicly confirmed a breach.
For engineering managers and IP owners, this changes what a ransomware attack is. It used to be mainly about locked servers and lost production days. Now it is also about design files, often including customers' designs, being copied out and offered for sale or publication. Below: what ESTsecurity counted, why drawings and PDM data are the new target, what the Jaguar Land Rover attack showed about the cost, which EU rules apply after an attack, and what to do now.
TL;DR: ransomware gangs go after design data
ESTsecurity counted 23 ransomware leak-site claims against Korean manufacturers up to 28 October 2026: 13 in the first half and 10 from July to October. Industrial equipment and automation (6) and automotive parts (5) were hit most. Recent claims included drawings, source code and design and production databases, and one group claimed 1 TB from an aerospace supplier's PDM server. Attackers use stolen design data for double extortion: pay, or the files go public. Lesson: backups bring systems back, but they do not bring secrecy back. Protect design files so that a stolen copy is useless, and know what you would have to report and to whom.
What did ESTsecurity count?
ESTsecurity's Security Response Center tracked the data-leak sites where ransomware groups name their victims, and counted every claim against a South Korean manufacturer up to 28 October 2026. The figures were reported by the Seoul Economic Daily on 1 November:
- 23 claims in total, 13 in the first half of the year and 10 from July to October.
- Industrial equipment and automation: 6 claims, more than any other sector.
- Automotive and parts: 5 claims, 4 of them in the second half.
- October alone: three companies listed, in industrial equipment and automation, auto parts, and steel and metals.
Two aerospace cases stand out. In February, a group called Beast listed a parts maker based in Changwon, South Gyeongsang Province, and claimed the company does business with Boeing, Airbus and Korea Aerospace Industries. In June, another group claimed to have stolen 1 TB from the PDM server of an aerospace parts maker that supplies Boeing. A PDM server is where a company keeps its CAD models, drawings, revisions and part data, so a claim like that is a claim on the core of the engineering department.
Bae Sang-min, who heads ESTsecurity's response center, told the newspaper that manufacturing makes up a larger share than other sectors in this year's Korean incident reports, and that attackers target it because the damage is high and company secrets are valuable. He added that such attacks can affect national competitiveness, not only the companies involved. A leak-site post is not proof. Groups exaggerate, and some list victims they never breached. But the count shows where the attackers think the money is.
Why are drawings and PDM data the new target?
Most ransomware groups now steal data before they encrypt anything. If the victim can restore from backups, the second threat still works: pay, or the data is published. For that threat to bite, the data has to hurt. Customer lists and HR files hurt. Design data can hurt more, because it is the product itself.
Engineering files have three features that make them good extortion material. They are valuable to competitors and to state buyers. They often belong partly to customers: a supplier's PDM server holds the OEM's drawings, interfaces and specifications, so a leak breaks contracts as well as secrecy. And they are hard to replace, because the know-how in a tolerance stack or a mould design took years to build. Our guide on ransomware targeting engineering firms covers the basics, and the true cost of CAD file IP theft for SMEs puts numbers on the damage.
Aerospace and automotive suppliers are especially exposed. They sit deep in supply chains, they hold design data from several customers at once, and they often run lean IT teams. Our articles on aerospace CAD file security and CAD protection for Tier-1 automotive suppliers describe the customer requirements those suppliers already face. Last week we covered how state hackers went after a NATO naval shipbuilder and an aircraft engine maker; criminal groups now chase the same kind of files for money.
Make stolen CAD files useless. CADChain encrypts CAD files at file level and applies per-file permissions that travel with the file, so a copy taken from a PDM server, a file share or a laptop cannot be opened by people you did not authorise.
👉 See how CADChain protects CAD files
What happens to a trade secret once it is on a leak site?
Under the EU Trade Secrets Directive (2016/943), information is a trade secret only while it is secret, has commercial value because it is secret, and is protected by reasonable steps. Ransomware attacks hit all three. If drawings are published on a leak site and mirrored, the owner may find it much harder to argue later that they are still secret. And in any dispute, the owner will be asked what reasonable steps it took before the attack.
That is why the steps you take before an incident matter as much as the response. Marking, access limits, encryption and logs are evidence of reasonable steps. Our guide to trade secrets for deep-tech startups explains the tests, audit trail requirements for IP litigation covers the logs that hold up in court, and CAD file ownership and legal proof shows how to prove what was yours and when.
Contracts add another layer. Supplier agreements with OEMs often require prompt notice of any security incident that touches customer data, and aerospace and defence work can involve export-controlled technical data with its own rules. Check those clauses now, not on the day a leak site lists your company.
What did the Jaguar Land Rover attack show about the cost?
The Seoul Economic Daily used the attack on Jaguar Land Rover as a warning. In September 2025, JLR shut down its IT systems after a cyberattack. Production stopped for about five weeks, parts orders and payments were disrupted, and about 5,000 vehicles a week were not built at its main UK plants. The UK's Cyber Monitoring Centre estimated the economic cost at £1.9 billion and said more than 5,000 UK organisations were affected. The UK government offered a £1.5 billion loan guarantee to help the supply chain.
Hwang Jae-hoon of AhnLab told the newspaper that JLR's production equipment and systems were so closely connected that the company could not isolate the affected parts and had to stop its plants. His advice: as factories connect more systems, plan not only to block attacks but to contain them and keep producing when one gets through. The same applies to design data. If every engineer can reach every project on one server, one stolen account can reach everything. Our analysis of the Loxone cyberattack shows how side systems such as portals and ticket tools widen that reach.
The Seoul Economic Daily also cited Fortinet's 2026 survey of more than 700 people responsible for operational technology: 46% said intrusions had caused outages that hit revenue, 50% outages that hit productivity, and 44% had lost critical business data or intellectual property.
Which EU rules apply after an attack?
European manufacturers hit by a similar attack face reporting duties that run on short clocks. Which ones apply depends on the company and the data:
- NIS2 (Directive 2022/2555): medium and large makers of machinery, motor vehicles, other transport equipment, electrical equipment, electronics and medical devices fall under Annex II. A significant incident needs an early warning to the national CSIRT or authority within 24 hours, a notification within 72 hours and a final report within one month. National transposition and details differ by country.
- Cyber Resilience Act, Article 14: since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents affecting the security of those products, with a 24-hour early warning and a 72-hour notification. Stolen firmware source code or signing keys can turn an IT breach into a product security incident. See our article on Cyber Resilience Act reporting.
- GDPR: if personal data was taken, the data protection authority must normally be told within 72 hours.
None of these rules protects your designs. They decide whom you must tell and when. Protecting the designs is your job, before the attack.
What should manufacturers do now?
- Map where your design data lives. PDM and PLM servers, file shares, engineering laptops, cloud sync folders, supplier portals and backups. Attackers find the forgotten copies first.
- Encrypt CAD files at file level. Server and disk encryption do not help once an attacker logs in as a user. Our article on CAD encryption vs access control and our comparison of file-level DRM and folder-level security explain the difference.
- Lock down the PDM server. Keep it off the open internet, require MFA for all admin and remote access, patch it on a schedule, and alert on bulk exports or unusual downloads. Our report on Oracle Agile PLM vulnerabilities shows how PLM flaws open the door.
- Limit access per project. An engineer on one programme does not need every customer's drawings. Review access when people change roles or leave.
- Separate customers' data. Store each OEM's designs in their own protected area, so one stolen account cannot expose them all.
- Keep offline or immutable backups and test restores. Backups do not undo a leak, but they stop attackers from holding production hostage as well.
- Prepare your reporting plan. Know which of NIS2, the CRA, GDPR and your customer contracts apply, who decides, and who sends each notice within 24 or 72 hours.
- Keep dated proof of your designs. Timestamped records of what you created and when help in disputes after a leak, and help show reasonable steps. Our complete guide to CAD file security and CAD security for supply chain collaboration cover the rest.
How does this fit the bigger picture?
This week our sister sites looked at other ways design data can be copied, rebuilt or reused without the owner's control.
- Rebuilding CAD from meshes. New AI tools, including MIT's CADFit research, turn mesh files back into editable CAD features. Read what AI mesh-to-CAD means for SOLIDWORKS teams on solidboris.com.
- A poisoned tool on engineering PCs. A trojanized copy of the Claude Code extension sat on Cursor's extension marketplace for about 11 hours on 29 October 2026. Our sister site explains what the backdoored extension means for Inventor automation workstations.
- Saying no to AI training. A new IETF draft proposes a shared robots.txt signal to opt out of AI training. Blended BORIS covers what the shared AI training opt-out means for Blender artists.
Conclusion
ESTsecurity's count is small in number but clear in direction. Ransomware groups attacking manufacturers now advertise drawings, source code and PDM databases, because design data gives them the strongest leverage. For suppliers, that leverage includes their customers' designs.
Restoring systems is only half of the recovery. Once design files are copied and published, secrecy cannot be restored from a backup. The companies that come through best will be those whose stolen files cannot be opened, whose access was limited per project, and who can show courts, customers and regulators the reasonable steps they took before the attack.
Protect the design files attackers want most. CADChain gives engineering teams file-level encryption, per-file permissions, access logs and blockchain proof of ownership for CAD files, across CAD systems, partners and suppliers.
👉 Protect your CAD files with CADChain
FAQ: ransomware and design data in manufacturing
What did ESTsecurity find?
Its Security Response Center counted 23 claims of ransomware attacks on South Korean manufacturers posted on leak sites up to 28 October 2026: 13 in the first half and 10 from July to October. Industrial equipment and automation (6) and automotive parts (5) were the most hit sectors.
Are these confirmed breaches?
No. They are claims posted by ransomware groups on their leak sites. Most companies were not named, and groups sometimes exaggerate or list victims they did not breach.
What design data was claimed?
Second-half claims included drawings, source code and databases linked to design and production. One group claimed to have taken 1 TB from the PDM server of an aerospace parts maker that supplies Boeing.
Why do ransomware groups want CAD files?
Stolen design data supports double extortion: even if a victim restores from backups, the group threatens to publish or sell the files. Design files are valuable to competitors and often include customers' designs.
Do backups protect against data theft?
No. Backups help restore systems after encryption, but they cannot undo a leak. File-level encryption keeps stolen copies unreadable.
Which EU rules require reporting?
Depending on the company, NIS2 (24-hour early warning, 72-hour notification, final report within one month), the Cyber Resilience Act for product security incidents, GDPR for personal data, and customer contracts.
How can CADChain help?
CADChain encrypts CAD files at file level, applies per-file permissions, logs access and timestamps files on a blockchain, so stolen copies cannot be opened and ownership can be proven. It does not replace backups, patching or legal advice.
