Their plant got encrypted. The shipments didn't stop.

Black Kite's 2026 report puts manufacturing at the top of the ransomware table – 1,183 victim companies through July, and no longer a US-only story. Every plant manager I know will read that as an IT headline, forward it to the CISO and walk back to the line. Here is what nobody on the floor asks: what happened to the material that shipped during the blackout, and in the two weeks after it? That material sits on your shelf now, carrying a certificate printed by a company still discovering what it had lost.

How a supplier's blackout becomes your escape

Ransomware locks the ERP, the MES, the LIMS and the QMS – and production does not stop. Plants do not idle because the servers are down. The paper always finds a way. That instinct is usually admirable. It is also how a cyber incident converts itself into a quality escape with an eighteen-month lag.

Walk the failure modes the way I would on a VDA 6.3 process audit:

• measurement records re-keyed from shift paper, gauge IDs assumed, calibration status unverified
• certificates re-issued from restored masters, lot and heat-number linkages patched where the backup was incomplete
• raw material and sub-tier substitutions phoned through on a Friday to keep your line running, re-qualified by nobody, disclosed to no one
• deviations approved verbally during the outage and papered afterwards, with dates that were not the dates

Under EN 9100 and AS9100 a record has to be authentic and attributable. Aerospace already has a name for parts whose pedigree cannot be verified: counterfeit risk. Not "the parts were good, only the paperwork burned". Segregation, containment, read-across – treat it exactly as you would a suspect part from the grey market. That is the frame I have carried through years of VDA 6.3 and AS9100 audit work, and no cyber insurance policy changes it.

Traceability rebuilt after a blackout is not evidence – it is testimony with a stamp on it.

Your incoming gate assumes a healthy supplier

Every incoming inspection plan I have written or audited rests on the same quiet assumption: a statistically healthy supplier behind the certificate. PPM trends, Cpk, run charts, skip-lot earned through years of clean deliveries. All of that intelligence lives inside the supplier's systems. The ones that just got encrypted. I have never seen a scorecard carry a state for "restored from backup last month". We built degraded states for fires, floods and strikes because those look like quality problems. Cyber gets filed under IT. No quality signal fires, and the skip-lot keeps skipping.

The response playbook already exists. I ran it as a tightened-inspection regime during supplier de-escalations at SNOP and WITTE: any wobble triggered same-day action – flip to 100% inspection on critical characteristics, freeze skip-lot, hold at source with per-batch evidence, QRQC on every anomaly until the trend ran clean. With A3 and Q-Wall behind it, that discipline took defect costs down 70% at SNOP, carried a quarter with zero critical customer escalations, and scaled across a 2,000+ multi-site workforce. The lesson was never heroics. It was triggers.

So define the degraded-supplier state in cyber terms. Any supplier that ran manual for more than a shift, or restored production or quality records from backup, enters tightened inspection automatically – every lot from the first suspicious timestamp until a fixed run of consecutive clean lots, certificates cross-checked against machine data rather than reprints. Not as punishment. Their recovery team is reconstructing your evidence base while your dock keeps waving parts through.

Put cyber events in the quality agreement, not the IT policy

Industry bodies keep pushing supply-chain cyber risk up the manufacturing agenda, and medtech is further ahead still – Health-ISAC has set a nine-domain baseline for writing cyber into procurement decisions. Good. Now translate it into paper the dock can use. Your CISO's questionnaires measure a supplier's controls before an incident; nothing in them governs the validity of material after one. And IT cannot gate a delivery. The receiving inspector and the quality engineer work from the quality agreement, so write the clauses there: notification within 24 hours of any incident touching production, measurement or traceability systems – operational impact, not just personal-data exposure; a shipped-lots list covering the outage window, each lot declaring its evidence basis as original machine data, manual record or reconstruction; a right of on-site verification plus a pre-agreed tightened-inspection window, so nobody negotiates containment mid-crisis; and no re-entry of quality records without dual sign-off, original paper preserved.

I hold a Certified Ethical Hacker certification and a place on T-Mobile's bug-bounty Hall of Fame for a clickjacking disclosure, and I do not raise that to pose as an IT auditor. Attackers and defective parts travel the same road: neither defeats the controls, both exploit the assumption nobody wrote a control for. Our incoming plans assumed a healthy supplier, and that assumption is now attackable from outside – 1,183 times in seven months. The new ISO 9001 revision leans hard on leadership and strategy. A supplier's blackout is system-level risk. It belongs on quality leadership's desk, not in the IT annex.

Quality owns the consequence. When a field failure lands and someone asks which heat lot sits under that serial number, the call does not go to the supplier's helpdesk. It goes to you, with an 8D form already open. If we own the consequence, we own the gate. The next ransomware report will count victims in the thousands. Somebody in this industry should start counting the lots.