Ransomware Attacks on Food and Ag Sector Jump 62% Through July

Ransomware incidents against food and agriculture businesses hit 227 through July, a 62% jump from the 140 attacks recorded over the same window in 2025. That's the headline number in the latest State of the Threat Report from Food and Ag-ISAC, the threat intelligence nonprofit that ranks food and ag as the eighth-most targeted sector for ransomware, accounting for 5% of all attacks.

The report lands as leading French supermarkets reel from recent cyberattacks that nobody has yet claimed. The breaches should serve as a wakeup call for the entire food industry, Food and Ag-ISAC says.

"[This is] going to be a pretty eye-opening event to a lot of food companies to look at their own processes and risk right now," director Jonathan Braley said.

This year is on track to be what the report calls "one of the highest-volume ransomware years on record," and ransomware remains "the most consistent and costly threat facing the food and agriculture sector."

Are food and ag firms singled out?

Not really, according to Braley. He stresses that food and ag companies are not disproportionately targeted compared with other sectors. Attacks across the economy remain "largely opportunistic" — mostly automated, not aimed at any one industry.

Most ransomware campaigns scan for exposed systems and lean on phishing or social engineering to compromise the first vulnerable organization that surfaces.

"They're going to target it without really caring what company is behind [the vulnerability]," Braley said. "The same top groups hitting other sectors are hitting food and ag."

Who is vulnerable?

The short answer: everybody. A decade ago, many agrifood operations assumed they were too small to be a ransomware target — and that may have held when systems and equipment ran offline. Now everything is connected: self-driving tractors in the field, smart sensors on grocery store refrigerators, cloud-based climate control for swine farms.

That interconnectedness means food and ag businesses, whatever their size, "face the same challenges any other sector would" on cyber vulnerabilities. And while attackers don't appear to single them out, these businesses are unusual in two ways: most are small, and many run on just-in-time deliveries of perishable goods.

"We're talking about not only the financial impacts and reputational impacts, but also the health and safety of people if they can't get the products they need," Braley said.

Every new device widens the attack surface. "All it takes is one vulnerability in your system," he added. "Food companies generally don't have the resources or the staff to be aware that this vulnerability is there. And with the addition of all this new technology onto farms, every time you put a new device on your field, it's also a device that you have to watch for a vulnerability and patch it."

What does this change for growers and processors?

No food or ag business — a major supermarket chain or a local poultry farm — is immune. None is helpless either. Braley points to several concrete steps:

• Turn on multi-factor authentication everywhere: email, financial platforms, cloud applications, inventory and logistics systems, remote access.
• Go phishing-resistant where possible. Citing a recent Microsoft digital defense report, Food and Ag-ISAC says MFA "reduces the risk of identity compromise by more than 99%," and recommends FIDO2 security keys and properly implemented passkeys.
• Patch. Deploying vendor-issued software updates to fix vulnerabilities and kill bugs is a priority.
• Change default passwords on new sensors and devices.
• Train employees. "Your employees are typically your weakest link," Braley said, recommending programs that help workers spot phishing campaigns and other attack methods.

Even very small operations can act, he argues, whatever their time, staffing, and cybersecurity know-how. Managed service providers have gotten cheaper over the years and can audit software, keep systems current, and watch network traffic.

"For a small organization, it's not a huge lift, and it's something they should start considering now," Braley said.

With attack volume running well ahead of last year's pace and no claim of responsibility yet for the French supermarket breaches, food and ag companies that haven't enabled MFA or audited their device inventory are the ones most likely to supply the sector's next data point.