For a co-operative, the campaign is the year squeezed into a few weeks. Members deliver every day, the weighbridge and the intake run from first light, the stores fill, and orders for feed and fertiliser cannot wait. A computer that stops in a quiet month is a nuisance. The same computer stopping in the middle of the harvest is a crisis, and the FBI warns that attackers may see it the same way.1
This guide turns what the FBI and Canada’s cyber security agency have published into a checklist for the weeks before your campaign. The cases are American and Canadian; the lessons travel.
Autumn 2021: six co-operatives in three weeks
Between 15 September and 6 October 2021, six grain co-operatives in the United States suffered ransomware attacks. The strains used included Conti, BlackMatter, Suncrypt, Sodinokibi and BlackByte. “Some targeted entities had to completely halt production while others lost administrative functions.”1
Two co-operatives hit that autumn went public. NEW Cooperative, one of the largest agricultural co-operatives in Iowa, said: “Out of an abundance of caution, we have proactively taken our systems offline to contain the threat.” The BlackMatter gang demanded $5.9 million.2
In Minnesota, Crystal Valley, which operates eight grain elevators, said the attack had “severely interrupted the daily operations” of the business. It could not mix fertiliser or fulfil orders for livestock feed, took systems offline and stopped accepting major credit cards. One farmer kept delivering grain with minor delays, but the old way: “It’s old school, with hand-written tickets instead of the computer reading the card on the side of your truck.” Reuters noted the timing: “The disruptions are hitting the Farm Belt as growers gear up for the autumn harvest.”3
What the FBI concluded
In April 2022 the FBI, in a notice coordinated with the US cyber security agency CISA and the Department of Agriculture, warned the sector that “ransomware actors may be more likely to attack agricultural cooperatives during critical planting and harvest seasons, disrupting operations, causing financial loss, and negatively impacting the food supply chain”.1
The reason is in the same notice: “Cyber actors may perceive cooperatives as lucrative targets with a willingness to pay due to the time-sensitive role they play in agricultural production.”1 In the middle of a campaign, every day of delay lands on the members.
Planting is exposed too: the FBI recorded two attacks in early 2022 that could have disrupted the supply of seeds and fertiliser.1
The notice also explains why the damage spreads. Grain feeds people and animals, so “a significant disruption of grain production could impact the entire food chain”. And “an attack that disrupts processing at a protein or dairy facility can quickly result in spoiled products and have cascading effects down to the farm level as animals cannot be processed.”1
Dairy co-operatives are not exempt. In May 2025 Arla Foods, a farmer-owned dairy co-operative, identified “suspicious activity at our dairy site in Upahl that impacted the local IT network” in Germany. Production there was temporarily affected, and customers were warned of possible delivery delays and cancellations.11
How they got in
The FBI listed the ways in: “known but unpatched common vulnerabilities and exploits, as well as secondary infections from the exploitation of shared network resources or compromise of managed services”.1
The last of these reaches co-operatives through their suppliers. In July 2021 a business management software company found ransomware on its network. The attackers demanded $30 million, and the infection spread to a number of the company’s clients, several of them agricultural co-operatives.1 A supplier’s problem became theirs.
Inside the co-operatives, the damage depended on what the attackers reached: “Production was impacted for some of the targeted entities, resulting in slower processing due to manual operations, while other targeted entities lost access to administrative functions such as websites and email but did not have production impacted.”1
So a co-operative’s exposure is wider than its own office. It includes the supplier of its management software, the IT provider with remote access, the contractor who looks after the dryer or the cold rooms, and every network they share.
From the office to the silo
Ransomware stops computers. Another kind of attack goes for the controls of the machines themselves.
Canada’s Cyber Centre reported in October 2025 that hacktivists had abused industrial control systems reachable from the internet. At a water facility they tampered with pressure, at an oil and gas company with a tank gauge, and on a farm they manipulated the temperature and humidity of a grain-drying silo, creating “potentially unsafe conditions if not caught on time”.4 The Record reported that the changes created “dangerous conditions before workers intervened”.5 The alert warns that such organisations may be victims of opportunity rather than chosen targets.4
In December 2025, 26 agencies, among them the FBI, CISA, the NSA and Spain’s Guardia Civil and Policía Nacional, published joint advisory AA25‑343A on pro-Russia hacktivists. It names food and agriculture among the sectors targeted, and describes the method: “minimally secured, internet-facing virtual network computing (VNC) connections”, after which the attackers “manipulate available settings from the graphical user interface (GUI) on the HMI devices”, the screens operators use.6
Closer to home, Forescout’s researchers tracked more than 20 attacks on refrigeration systems claimed by hacktivist groups since January 2026. In those claims, the most common targets were “fruit storage facilities, wineries, supermarkets” and other agricultural and food processing sites in Spain, Italy and other European countries, and the most common method was changing temperature and defrost settings. These are claims: Forescout does not say they were verified.9
ENISA, the EU’s cyber security agency, counted 37 claimed intrusions into operational technology (the systems that run machines and plants) in the third quarter of 2025 and 124 in the fourth, with “a rising interest in exploiting configurations, interfaces, and credentials”. It adds its own caveat: most claims named neither methods nor victims, and “OT disruption remained largely unverified”.10
The calendar in Spain
The evidence on timing is American. Spanish co-operatives have peaks of their own: the olive harvest, the fruit campaign, the grape harvest. In each, intake, cold rooms, mills or presses and invoicing run flat out for a few weeks. Nothing in the American cases is specific to grain: a co-operative that cannot weigh, store, cool or invoice during its campaign is under the pressure the FBI described.1
The European picture points the same way. ENISA names food production, processing and distribution among the sectors most affected by ransomware claims in the EU in 2025, and Spain was the fourth most targeted member state, with 12.2% of claims.10 At home, INCIBE describes the agrifood sector as made up mostly of SMEs, micro-SMEs and the self-employed, with low cyber security maturity. Among its examples is an attack on automated irrigation in northern Israel in April 2023, which caused crop losses and forced farmers to irrigate by hand.8
There is a legal side too. NIS2, the EU’s cyber security directive, does not name primary production. Co-operatives that process food at industrial scale, such as mills and wineries, or that sell wholesale, may be covered once Spain passes its law, if they are medium-sized or larger.12 Our guide to NIS2 and Spanish food companies explains who is in.
Before the campaign: a checklist
The FBI’s advice starts with the question every campaign raises: what must keep working, and how would you run it by hand? “Identify critical functions and develop an operations plan in the event that systems go offline. Think about ways to operate manually if it becomes necessary.”1 The steps below put that advice, and the agencies’ other recommendations, into the weeks before the first delivery.