Most common cyberattacks in the food industry: Real cases and how to solve them

The food industry has undergone rapid digital transformation in recent years. From automated production systems to supply chain management platforms, technology has improved efficiency. However, this digitalization has also made companies in the sector attractive targets for cyberattacks.

In this article, we will show the most common cyberattacks in the food industry, real cases that impacted the sector, and effective strategies to prevent and solve cybersecurity incidents.

The combination of critical infrastructures, large volumes of data, and connected networks makes this industry especially vulnerable to operational interruptions (halting all activities, leading to huge financial losses), intellectual property or recipe theft, SCADA or ICS system attacks, or the hijacking of sensitive data from suppliers and customers.

Most common types of cyberattacks in the food industry

Ransomware

Ransomware is one of the most destructive attacks. It involves encrypting critical information and demanding a ransom in exchange for its release. However, as cybersecurity specialists, we do not recommend paying the ransom, as it is not a guarantee of data recovery.

Real case example: In 2021, JBS, the world’s largest meat processor, suffered a ransomware attack that halted its operations in the US, Canada, and Australia. The REvil group was responsible, and the company paid 11 million dollars in Bitcoin to regain access to its systems

How to prevent ransomware attacks?

• 3 copies of data: Have at least three copies of your important data (the original and two backups).
  
  
• 2 types of media: Store the backups in at least two different devices or media, such as an external hard drive and a cloud storage service.
  
  
• 1 offsite copy: At least one backup should be stored in a physically separate location to protect against local disasters such as fires, theft, or hardware failure.
  
  
• 1 immutable copy: At least one backup must be immutable, meaning it cannot be modified or deleted, even in the case of a ransomware attack or tampering.
  
  
• This rule provides robust protection to ensure data is safe in different risk scenarios.

Phishing and spear phishing

Phishing attacks aim to trick employees into revealing credentials or installing malicious software. They are typically launched via email, impersonating a real company or person.

Real case example: Employees of Ingredion, a multinational food ingredient company, were victims of targeted spear phishing campaigns. The goal was to access financial systems and production planning systems.

How to prevent phishing attacks?

Implement two-step verification (2FA) and conduct phishing attack simulations to train your team. This is the basic cybersecurity every company should have in place.

Attacks on SCADA and ICS systems

SCADA stands for Supervisory Control and Data Acquisition. This system is used to monitor and control industrial and infrastructure processes by collecting and analyzing real-time data.

Industrial Control Systems (ICS) are fundamental technologies designed to monitor, control, and automate industrial processes. These systems ensure that industrial operations are efficient, safe, and continuous. For example, an ICS can manage production lines in a factory.

Thus, these are essential systems for food production and automation. Since they are connected to the network, they are vulnerable to cyberattacks that can alter, for example, the temperature of storage chambers, change ingredient amounts, or stop production.

How to prevent attacks on SCADA and ICS systems?

To prevent this type of attack, it is important to update the firmware, segment the network between IT and OT, and continuously monitor for anomalous traffic.

Data exfiltration and industrial espionage

Data leaks occur when competitors or malicious actors seek information on formulas, processes, or confidential contracts.

Real case example: Although the 2017 NotPetya attack was destructive, Mondelez was one of the affected companies. Their global operations and sensitive data were compromised.

How to prevent data exfiltration?

Data leaks can occur for various reasons, such as stolen user passwords. In these cases, detecting leaks is extremely difficult, as data downloads are legitimate through a company account.

For issues like these, tools like WWatcher allow monitoring of internal file downloads, limiting the amount of data a user can download. If they exceed the limit, the tool automatically blocks the user to prevent further downloads. It also detects simultaneous downloads from different IPs.

Recent attacks have shown that any organization, regardless of size, can be the victim of a cyberattack with million-dollar consequences.

At ESED, we help food industry companies protect their digital assets, strengthen their systems, and train their teams. We work with a fixed monthly fee tailored to the real needs of each company. You can simulate your budget through the following link.