To future-proof itself, the animal nutrition industry is undergoing a digital transformation not only to become more sustainable, but also to make smarter purchasing decisions and formulate with greater precision and consistency while making cost savings.
The digital push in the animal nutrition industry will inevitably lead to more use of solutions such as artificial intelligence, robotics, blockchain, or big data.
Digitalisation is also helping strengthen the sector's relationship with its customers, by developing a deeper understanding of their needs and facilitating the use of feed additives while respecting data privacy, which remains critical.
At the same time, in the aftermath of the COVID-19 pandemic, the delivery of IT services and systems has changed. Many businesses now work in a hybrid fashion, and IT services, including information security controls and measures, have had to adapt.
Using relevant digital technologies and the sharing of information, however, opens the door to potential cyber-threats such as social engineering attacks, computer viruses and the loss or theft of data, putting companies in the sector at risk.
The increase in digitalisation in the animal nutrition and animal agriculture sectors, which are relatively new to running digital-centric businesses compared to other industries, also comes with its fair share of risk. Indeed, animal agriculture has traditionally focused on performance and safety, not necessarily digital security.
The risks are numerous, as pointed out by researchers at the UK’s Harper Adams University in a 2019 white paper.
For example, digitally traceable farm management systems aim to improve profitability, but if criminally exploited, there is a chance of having leaked confidential data that damages a farm’s reputation or even makes it a target for criminal gangs looking to steal farm assets. Animal welfare is also known to drive “hacktivists” to target farms and cause financial damage if they have concerns around the treatment of livestock.
There is some awareness in the industry of the menace that cyber security issues pose.
“Cybercrime has become one of the most important business risks globally, with attacks increasing in numbers, frequency and sophistication,” stated Marcus Pospiech, Head of Global Digitalisation & Business Processes, BASF Nutrition & Health, in response to a request for comment from Feedinfo.
“Cyber-attacks, specifically targeting the industry, are not widely reported or, indeed, commonly discussed. However, like any industry which is reliant on technology for its processes, the agriculture sector is vulnerable to cyber-attack if up-to-date security measures are not in place,” also commented Ivo Lansbergen, President Animal Nutrition and Health & Member of the Group Executive Committee at dsm-firmenich.
However, experts are concerned that investment from the agriculture sector in countermeasures is insufficient. Dr. Ali Dehghantanha, a University of Guelph computer scientist whose Cyber Science Lab is investigating the increasing number of cyber-attacks on agricultural operations and helping farmers fight off hackers.
In 2021, a market research study co-authored by Dr. Dehghantanha concluded that as of 2019, the global smart agriculture market – consisting of various smart farming technologies – was worth more than $10 billion. However, spending on cybersecurity in agriculture accounted for only about 3% of total cybersecurity spending in North America, far outpaced by spending on security in other applications from finance to health care.
“The level of cybersecurity protection in agriculture is minimal to non-existent. The agricultural sector is a soft underbelly from a cybersecurity point of view,” he said in August 2022, stressing that governments need to develop data security standards for the agricultural sector.
“In light of the past 18-24 months, where supply chain vulnerability has been highlighted on a world stage, it is perhaps more important than ever for the agri-food sector to be cognizant of the ever-evolving threats that can emerge from the cybersecurity landscape and prioritise measures to protect their systems and data from potential attacks,” also stressed dsm-firmenich’s Lansbergen.
Increase of cyber-attacks in 2020-2022
Cyber-attacks in agriculture are underreported due to a lack of detection capability, but between 2020 and 2022 there were several major cyber incidents which impacted agricultural businesses of all sizes, from large corporate farms to small- and mid-size operations.
One of the most famous ransomware attacks against a food production and agriculture company took place in May 2021 when the REvil gang hit JBS Foods, disrupting meat processing across Australia and North America for almost a week.
"The temporary shutdown reduced the number of cattle and hogs slaughtered, causing a shortage in the US meat supply and driving wholesale meat prices up as much as 25%," the Federal Bureau of Investigation (FBI) said at the time.
Another example is Minnesota’s Crystal Valley Cooperative which was targeted in a ransomware attack in September 2021 and was forced to take systems offline. Reuters reported that the attack left Crystal Valley unable to mix fertilizer or fulfil orders for livestock feed.
That same month, Russian hackers carried out a ransomware attack on New Cooperative in Fort Dodge, Iowa, demanding $5.9 million to unlock the computer networks used to keep food supply chains and feeding schedules on track for millions of chickens, pigs and cattle. New Cooperative was forced to take its computer network offline.
A September 2021 FBI cyber division article warns of the risk of ransomware attacks targeting the food and agricultural sector. It also shares the example from November 2020 of a “US-based international food and agriculture business which was unable to access multiple computer systems tied to its network due to a ransomware attack by OnePercent Group ... The company did not pay the $40 million ransom and was able to successfully restore its systems from backups.”
“Cyber actors may perceive cooperatives as lucrative targets with a willingness to pay due to the time-sensitive role they play in agricultural production. Although ransomware attacks against the entire farm-to-table spectrum occur on a regular basis, the number of cyber-attacks against agricultural cooperatives during key seasons is notable,” the FBI said.
Naturally, cyber-attacks are also not just restricted to the US.
In Canada, pork and poultry producer Maple Leaf Foods had a ransomware incident in November 2022, which caused a temporary system outage and other operational disruptions.
In France, between early-2021 and mid-2022, five of the largest animal nutrition companies in the northwest were cyber-attack victims, according to Hervé Vasseur, President of Brittany feed manufacturers’ association Nutrinoë, speaking at a Tecaliman conference in September 2022. Impacted companies included large feed producers such as Eureden and Avril Group.
In February 2022, the FBI released a joint cyber security advisory with cyber security authorities in Australia and the UK, warning of an evolution in ransomware techniques.
Going forward
Looking at cyber criminality in all industries and sectors, the recently published 2023 Thales Data Threat Report, based on a survey of nearly 3,000 IT and security professionals in 18 countries, found an increase in ransomware attacks, and increased risks to sensitive data in the cloud. 47% of IT professionals surveyed said security threats are increasing in volume or severity. 48% reported an increase in ransomware attacks. 22% even reported that their organisation had been a victim of a ransomware attack. IT professionals survey by Thales identified their cloud assets as the biggest targets for cyber-attacks.
Based on summary of animal agriculture sector cybercrime mentioned between 2000-2022 or looking at the Thales report data, it doesn’t take a great stretch of imagination to believe that this year and next will see a continuation of the cyber threats in the sector.
Dr. Dehghantanha also says that his research group of digital investigators is called roughly once a month by farmers or security companies to help in tracing suspected cyberattacks on farming networks. He expects the number of calls to increase.
What to Do
There are various steps animal nutrition and animal agriculture companies can take to prepare for and prevent cybersecurity breaches and ransomware attacks. However, it is likely that what is needed is deeper collaboration on an ongoing basis between our industry and the cyber security profession.
Even leading animal nutrition companies with resources like BASF and DSM who have their own cybersecurity measures cooperate with experts and partners in global networks.
BASF’s Pospiech said his company has what he calls a Global Cyber Security Organisation, which has the task of protecting BASF’s systems from hacker attacks, while protecting IT systems and the data and business processes they handle. Additionally, BASF has a Cyber Security Defence Centre that monitors the company’s digital infrastructure 24/7 to look for signs of malicious activities and escalate confirmed security incidents, actively handle cyber security incidents/attacks globally, and offer digital forensics activities.
“In 2022, we continued to raise employees’ risk awareness with mandatory, regular online training for all employees and complementary offerings such as seminars, case studies and interactive training. These increasingly addressed aspects of working practices that have changed as a result of the coronavirus pandemic, such as cybersecurity when working from home,” Pospiech said. “Our global network of information protection officers comprises around 600 employees. They support the implementation of our uniform requirements and hold events and seminars on secure behaviours. Around 58,000 employees had been trained on the basics of cyber security and information protection in 2022.”
“We have taken a number of measures, including mandatory online training modules for all employees multiple times a year, in addition to our cybersecurity team providing the entire company with up-to-date information on an ongoing basis,” said dsm-firmenich’s Lansbergen. “The big difference between good and bad cyber security comes down to raising awareness among all employees. That is why constant training of employees is essential.”
