Dole Hit by Ransomware Attack, Disrupting North American Food Production Earlier this month, food producer Dole suffered a ransomware attack that forced the company to temporarily shut down its North American production plants and halt shipments to grocery stores. The incident first came to public attention yesterday after a Texas grocery store, Stewart’s, shared an internal Dole memo on Facebook explaining the shortage of prepackaged salad. The memo stated that plants were closed and shipments paused while the company worked to contain the disruption. Dole later confirmed the attack in a public statement, revealing that it had swiftly engaged cybersecurity experts to contain the threat and secure its systems. The company also notified law enforcement and is cooperating with the investigation. While Dole reported that the operational impact was limited, it did not disclose the ransomware strain involved, whether data was exfiltrated, or if a ransom demand was made. The attack follows a similar 2021 breach at meat supplier JBS, where the REvil ransomware gang disrupted operations and extorted an $11 million payment. Dole’s incident highlights the ongoing vulnerability of critical food supply chains to cyber threats.

Ransomware Surge Targets U.S. Food and Agriculture Sector in 2023 The U.S. food and agriculture sector faced 167 ransomware attacks in 2023, ranking it the seventh most targeted industry nationwide, according to the Food and Agriculture-Information Sharing and Analysis Center (Food and Ag-ISAC). The newly formed group, established in 2022 after a wave of cyberattacks disrupted food pricing, released its first annual report detailing the growing threat. In the first quarter of 2024, the sector recorded 40 attacks, a slight decline from the same period last year. However, law enforcement disruptions including takedowns of LockBit and BlackCat have contributed to a noticeable drop in attacks in February and March. Without these interventions, 2024 could have surpassed 2023’s totals, according to Jonathan Braley, director of Food and Ag-ISAC. Ransomware affiliates are now shifting to new strains, such as Play, which has already claimed five agriculture sector attacks in 2024. LockBit was the most active group in 2023, responsible for 40 attacks, while BlackCat targeted 15 agriculture victims. Other notable threats included Play, 8Base, and Akira. The FBI also warned last fall about Snatch ransomware targeting the industry. The USDA confirmed it was affected by a ransomware attack in 2023, linked to the exploitation of a popular file transfer tool, exposing sensitive industry data. High-profile victims included Dole, Sysco, and Mondelez, with Dole’s February 2023 attack disrupting grocery store shipments of salad kits. Beyond immediate disruptions, ransomware attacks can trigger supply chain cascades, delaying planting, harvesting, and distribution. The report highlights risks to intellectual property, including years of genetic crop research vulnerable to theft. Congress has introduced bipartisan legislation to strengthen cybersecurity in the sector, including a 2024 bill to fund digital defenses and a 2023 proposal to create a cybersecurity hub within the National Telecommunications and Information Administration, offering guidance and a hotline for agricultural producers. The IT-ISAC, which tracks ransomware trends, recorded 2,905 attacks across all industries in 2023, underscoring the broader threat landscape.