Ransomware hackers find vulnerable target in US grain supply

At least three U.S. grain vending systems have been infected with ransomware in recent weeks, raising fears that hackers have found an easy target in a vital part of the U.S. food supply chain.

The three known victims are grain cooperatives in the Midwest who buy grain from farmers, then process, store, and resell it for such purposes as feed and fuel. The attacks, in which organized cybercriminals block organizations’ computers and demand a ransom for a program to unlock them, have slowed the operations of distributors, hampering their ability to quickly process grain as it arrives.

The timing is particularly bad, said Charles Hurburgh, director of the grain quality lab at Iowa State University.

“We go into harvest, and right now is when they bring in a lot of grain and produce a lot of grain,” Hurburgh said. “It’s a really nasty situation.”

Like many industries, grain production involves highly digitized operations that were previously done by hand. Hackers who deploy ransomware, lock down their computers, and demand payment, may not be able to shut down distributors completely, but they can slow them down dramatically.

The largest of the three known victims, New Cooperative in Iowa, is still working to restore automated systems after it was hacked last month, a spokesperson said in a statement. An employee of another, Farmers Cooperative Co., also in Iowa, declined to comment, citing the advice of lawyers for the company. The third, Crystal Valley in Minnesota, did not respond to emails and voicemails.

The private files of the three were posted on the websites of ransomware hackers, which NBC News visited, a common tactic ransomware hackers deploy against victims who refuse to pay.

Although grains are a key part of the US food supply chain, its market is large enough that the country does not see a noticeable effect from the slowdown in production from three distributors, Hurburgh said.

The fact that there have been three known attacks in a short time indicates that the hackers may have broken into a company that runs internet services in the industry or found a vulnerability in the software they are trending. to use, said Allan Liska, ransomware analyst for cybersecurity firm Recorded Future. This means that there could be other victims who have not yet been made public, he said.

“The fact that there are three so close to each other tells me that there are probably others that we don’t know,” Liska said.

Eric Goldstein, deputy executive director of the US Cybersecurity and Infrastructure Security Agency, or CISA, said the attacks were not a targeted attack on the agricultural industry, but rather the result of opportunistic hackers exploiting all the victims they they could.

“Ransomware incidents can affect any organization, including small ones,” he said. “This can be difficult with an organization maybe with limited resources or one that doesn’t have a dedicated security team. “

Victims or anyone else looking to avoid ransomware infections can visit CISA’s dedicated resource center, stopransomware.gov, Goldstein said.

“We know that all sectors are at risk. Every organization, big or small, may be a victim, which is why it is important that all organizations take the necessary steps to secure their own networks, ”he said.