The food and beverage industry has proven to be a vulnerable target for cyber criminals this year. At least 40 companies in the sector have suffered cyberattacks, of which ransomware events have been the most common and costly. With that, cyber events can have long-lasting implications for companies, their vendors, and customers.
Further, all types of food and beverage companies are at risk of a costly cyber incident. Any business with an online component, that sends or stores electronic data (even through a third party or cloud-based system), or relies on technology to conduct its operations can be a target.
The ransomware attack earlier this year against JBS (one of the world’s largest meat processors) set a new awareness in the industry and demonstrated that food and beverage companies may be ill-prepared to fend off cyberattacks. In order to resume operations, JBS paid an $11 million ransom and suffered additional losses from temporarily halted operations. The actual downtime was only 2-3 days, but it took a substantial amount of time and money to get back on track.
With these attacks, the industry’s vulnerabilities are coming to light:
- Antiquated systems and software are prevalent.
- Companies have not made cyber security a top priority and cyber criminals continue to take advantage of that.
- An interruption in production can be felt throughout the supply chain and can cause severe damage.
- The risks will continue to increase if not addressed.
What do food companies need to know and how can they protect themselves? Let’s start with the basics.
The Basics of Cyber Attacks
A cyberattack can start out with something as simple as a phishing incident, a seemingly legitimate email that contains malicious attachments or links which initiate the download of ransomware. During an attack, cyber criminals can gain access to a company’s systems, disable its network, and exfiltrate data for potential public disclosure.
Cyber criminals then demand a ransom payment in exchange for allowing a company to regain access to its network. After obtaining payment, criminals often threaten a second payment in return for not disseminating the illegally obtained information.
Many of these bad actors use cryptocurrency to convert ransom payments into cash, avoiding a money trail and allowing them to go undetected.
35% of businesses that have been victimized by a ransomware attack have paid a ransom between $350,000 – $1.4 million and 7% of businesses paid ransoms in excess of $1.4 million. (Cybereason, 2021)
With large payouts and very little chance of getting caught, ransomware attacks continue to climb.
The most common methods used by cybercriminals for malware which can include ransomware are:
- Malicious Websites
- Mail-spam Emails
- Remote Desktop protocols
- USB Memory Sticks
It is estimated that a ransomware attack occurs every 11 seconds (Cybercrime Magazine, 2021). Given the high risk of a cyberattack, it is critical to deploy risk mitigation protocols.
How Food Companies Need to Prepare
What are best practices to reduce the likelihood of your company being victimized by a cyberattack?
Limit access and protect data:
- Limit who can access the company’s system and how the system is accessed.
- Implement multifactor authentication and encryption for all users.
- Use an endpoint security solution, run regular scans with antivirus programs that use frequently updatedsignatures, set a continuous vulnerability scanner, and conduct penetration tests regularly.
- Use spam filters to prevent phishing emails and executable files from reachingend users.
- Implement “block andallow” lists for websites and have an allowed applications list.
Train staff:
- Implement mandatory quarterly cybersecurity training for all employees including the handling of phishing emails, awareness of malicious websites and attachments, and not to enable macros in Microsoft Office attachments.
- Implement web navigation without using the links embedded in emails.
Conduct Regular Backups and Updates:
- Back up data every 24 hours if possible.
- The backup data must be easily accessed and used.
- Always runs the most up-to-date version of software.
Cyber Insurance Is a Vital Part of Cyber Risk Management
There is no one-size-fits-all solution since every food company is unique.
It is critical to implement proper controls specific to your organization and consider Cyber Insurance to protect your business.
Cyber insurance protects organizations from the financial impact of cyber-related incidents. Having a cyber insurance policy can help minimize disruption during and after a cyber incident and can cover certain financial costs, allowing companies to recover more quickly.
