Crime is a malicious (and inevitable) branch of progress. As industry and technology evolve, so too do the machinations of those willing to test, infiltrate, and break the system for personal profit.
As integrated web services become more robust and embedded in foodservice, it should come as no surprise that would-be criminals will do the same, and they’ve come a long way since the first dine-and-dash years ago.
Last year, a ransomware attack on JBS USA completely halted company operations until a hefty, $11 million ransom was paid. The attack interrupted production at JBS plants across the country that were responsible for 20% of processed pork and 25% of processed beef; JBS poultry plants were also targeted. The attack caused wholesale meat prices to rise almost 2%. The White House became involved and suspected Russia of masterminding the attack. But little could be done, and the ransom was paid.
Most food businesses will never be affected by something of this scale. Nonetheless, as categories like grocery go digital – even virtual – there are precautions to take, and lives, identities, and data to protect.
How Common Are Cyberattacks?
The short answer: super common. As of this writing (Thursday, Dec. 8), New York City’s Metropolitan Opera has been under attack for three days; the website and box office have been shut down. A brief Google search reveals: Amnesty International Canada: cyberattack. New Zealand government: cyberattack. French hospital systems: cyberattack.
If you don’t have digital armor, it may be time to get some.
According to the State of Data Exfiltration and Extortion 2022 report by Titaniam, a cybersecurity platform and service, over 70% of those surveyed had been attacked in the past five years. Of those victims, 68% had their data exfiltrated – stolen – and 60% were extorted.
“We continue to see a flood of ransomware attacks, which spawned the increasing adoption of Ransomware as a Service (RaaS) in all verticals,” said Arti Raman, CEO of Titaniam, to The Food Institute.
[“These attacks] include the foodservice and retail industries. Actors behind these attacks have honed their skills in ransom negotiations and extortion processes, creating a playbook they can use to go after nearly any organization. Because of this, the number of ransomware attacks we’ll see in 2023 will only continue to rise and move downstream.”
Because everybody eats, everybody is a potential victim.
Most cybercriminals aren’t interested in individuals, however, but rather large blocks of data associated with hundreds (or hundreds of thousands) of retail customers and employees alike. Gaining access to systems and data on a mass scale disrupts not only business operations but the well-being of the parent company, casting aspersion and doubt once the firewalls have burnt down and companies are forced to confront that they’ve been victimized in public and costly ways, losing customers and market share.
“You play in a muddy pond, you are going to get muddy,” said Craig Keefner, executive director of the self-service and kiosk association, and a leader in QSR, fast casual, point-of-sale, and kiosk operations, to The Food Institute.
“Home and corporate are different environments, and the usual caveats and cautions always apply. Maintain focus on outside third-party vendors and suppliers that access your commerce and ordering platform,” describing a situation at Target when a vendor logged into the supply chain software using free malware that hadn’t been updated. A virus spread across the primary domain controllers, disrupting business and prompting a massive internal audit of security actions and procedures.
“The usual complaint about IT is that they are never 100% happy until no one can access your network,” he added, “and the increased number of remote workers logging into corporate systems are yet another danger (much like third-party vendors accessing your corporate system).”
An Ounce of Prevention
No system is 100% safe. Still, taking more than the most rudimentary precautions will go a long way toward keeping your data – and your business – secure.
“The best way to prevent ransomware losses is to prepare for the threat,” said Richard Gardner, CEO at Modulus, “and that includes common best practices, like maintaining encrypted backups of critical data, including necessary source code, offline.”
If JBS had updated all data nightly in a remote place, for instance, the $11 million ransom and ensuing price chaos would never have occurred.
“It is important to regularly audit corporate systems for vulnerabilities,” Gardner added.
“Notably, companies of all sizes should have a response plan to deal with breaches. Cybersecurity education for employees can go a long way, given that phishing is an increasingly common way to initiate an attack.”
Unfortunately, preventing cyberattacks isn’t as simple as closing up shop for a day and implementing new protocols and systems. It’s difficult to rob a bank the same way twice, and that notion applies even more in cybersecurity. Too often it takes a victim to reveal the method behind the malice, prompting security companies to reverse-engineer protections based on the crime.
“Organizations in 2021 and 2022 heavily invested in prevention, detection, and backup technology to combat these attacks,” Raman continued, “however, in 2023 that may not be enough – as threat actors get more creative and innovative with their malicious attacks, data security professionals must embrace newer, more innovative, and effective technologies to defend their systems.
“While no prevention technology can guarantee 100% protection, new technology must focus on assumed breach concepts and provide more guardrails.”
