AkzoNobel Data Breach Targets US Operations: Supply Chain Cyberattacks and Zero-Trust Security in the Manufacturing Sector

By Kim Njuki March 11, 2025 Updated: August 25, 2026 4 min read

AkzoNobel, one of the world's largest paint and coatings manufacturers with brands including Dulux, International, and Sikkens, has disclosed a cyberattack targeting its United States operations. The incident exposed sensitive operational and potentially customer data, adding to a growing and deeply concerning pattern of cyberattacks against global manufacturing sector leaders and reinforcing the critical urgency of zero-trust security architecture adoption across industrial enterprises.

AkzoNobel's Cybersecurity Incident: What We Know

AkzoNobel's disclosure confirmed that attackers gained unauthorized access to systems in its US operations, resulting in data exposure. While the company has not fully detailed the nature of the compromised data, manufacturing companies of AkzoNobel's scale typically hold sensitive data spanning customer procurement contracts, proprietary formulation data, supply chain partner information, financial transaction records, and employee personal data across their US workforce.

The timing of the attack — disclosed in early 2026 — is consistent with a wave of threat actor activity targeting industrial companies with global operations and complex, multi-vendor IT and OT (operational technology) environments. Manufacturing has become the single most targeted sector for ransomware attacks globally, surpassing financial services and healthcare, according to multiple industry threat reports.

Why Manufacturing Is the New Ransomware Bullseye

The manufacturing sector's vulnerability to cyberattacks stems from a combination of factors that threat actors have learned to exploit systematically. Legacy OT systems — programmable logic controllers (PLCs), SCADA systems, and industrial control systems (ICS) — were designed decades ago for reliability and uptime, not security. They often run outdated operating systems, lack encryption, and were never designed to be internet-connected — yet increasing operational efficiency demands have pushed IT/OT convergence, exposing these systems to corporate network threats.

Manufacturing companies also operate complex, globally distributed supply chains with hundreds of tier-1 and tier-2 suppliers requiring varying levels of system access. Each supplier relationship is a potential initial access vector. A compromised HVAC vendor's credentials were the entry point for the infamous Target breach; similar third-party access relationships represent perpetual risk in large manufacturing environments.

For AkzoNobel, which operates over 60 manufacturing sites across more than 150 countries with a workforce exceeding 32,000, the attack surface is enormous. Coordinating security controls across this footprint — particularly in environments where operational continuity requirements limit the pace of security patching — is genuinely difficult.

Zero-Trust Architecture: From Buzzword to Operational Imperative

The AkzoNobel incident reinforces why zero-trust security architecture has evolved from a marketing concept into an operational necessity for large enterprises. Traditional perimeter security — the castle-and-moat model where inside-the-firewall users and systems are trusted by default — is fundamentally inadequate for modern enterprise environments characterized by remote work, cloud-hosted applications, and extensive third-party access.

Zero-trust operates on the principle of "never trust, always verify": every user, device, and system must authenticate and be authorized for every resource access request, regardless of network location. For manufacturing environments, this means implementing identity-based access controls for OT systems (historically managed through physical and network segregation alone), enforcing multi-factor authentication for all administrative and remote access, and applying micro-segmentation to limit lateral movement within networks.

Microsoft's Zero Trust deployment guides, NIST SP 800-207, and the CISA Zero Trust Maturity Model provide practical frameworks for organizations navigating this transition. The AkzoNobel breach, like similar incidents at Clorox (2023), DP World (2023), and Schneider Electric (2024), demonstrates the cost of delayed zero-trust adoption in tangible terms: operational disruption, data exposure, regulatory scrutiny, and reputational damage.

Supply Chain Security: The Invisible Attack Surface

Beyond internal security hardening, the AkzoNobel incident highlights supply chain security as a critical and often underinvested discipline. The MITRE ATT&CK framework documents numerous techniques threat actors use to exploit trusted supplier relationships — from compromise of software update mechanisms (as in the SolarWinds attack) to exploitation of remote access tools used by managed service providers (as in the Kaseya VSA attack).

For AkzoNobel and comparable global manufacturers, supply chain security programs must encompass continuous monitoring of supplier security posture, incident reporting requirements in supplier contracts, and isolation of supplier access to only the specific systems and data required for the contracted service.

Regulatory Landscape for Manufacturing Cybersecurity

The regulatory environment for manufacturing cybersecurity is tightening. The EU's NIS2 Directive, which expanded cybersecurity obligations to manufacturing sector entities with over 250 employees, came into effect in October 2024. The US SEC's cybersecurity disclosure rules require public companies to report material cybersecurity incidents within four business days. CISA's cybersecurity performance goals provide a voluntary but increasingly referenced baseline for critical infrastructure sectors including manufacturing.

For AkzoNobel — a publicly listed company on Euronext Amsterdam — NIS2 compliance, SEC disclosure obligations (for its US-listed ADRs), and growing insurance market requirements for cyber hygiene certifications all create meaningful compliance pressure that aligns with, and should accelerate, the security investments needed to prevent future incidents.