Agriculture & Food — Cyber Threat Activity

Agriculture and food is critical infrastructure that is rarely defended as such, and our log records more than 570 incidents against it across 66 countries, over 185 in the trailing 180 days. 69 groups have been attributed at least one claim, led by Qilin (79), Akira (68), LockBit (40), Play (40) and RansomHub (39). The sector's exposure is seasonal in a way that no other sector's is. Harvest, slaughter, processing and cold chain all run to biological deadlines, so an outage during a narrow window destroys perishable stock outright rather than merely deferring revenue, and attackers who understand that timing hold unusual leverage. Consolidation compounds it: a small number of processors, cooperatives and logistics operators sit between farms and retailers, so a single compromise can idle a disproportionate share of national capacity. The sector also attracts attackers with no interest in payment. CISA and partners named Food and Agriculture explicitly among the sectors where pro-Russia hacktivist groups reached internet-exposed human-machine interfaces protected by default, weak or absent passwords, then altered setpoints and locked operators out of their own controls. Those agencies assess the groups lack the engineering knowledge to predict the physical consequences of what they change, which makes the activity less predictable than a ransomware negotiation rather than less dangerous. Recorded geography is United States-led at 219 claims, then Canada, Italy, France, Spain and the United Kingdom. Only 8 groups carry a researched association with the sector at profile level, against 69 attributed through incidents, so this is a sector where the measured log, not the research graph, is the honest evidence base.

All sectors

Recent incidents

Threat actors targeting Agriculture & Food

Where these victims are

Malware used against Agriculture & Food

Families used by the threat actors that target this sector, derived from actor tooling rather than observed in these incidents directly.

Coverage. 92.8% of incidents in our log carry a sector classification; the remainder name a victim we have not placed in an industry. Counts here are a floor, not a total, and are not comparable between sectors of different sizes.

Read the full analysis on IntelFusions