Manufacturers are a prime target of cybercriminals, a report from Zscaler finds, and artificial intelligence boosted assaults against all industries by 276% in a year. A separate report found attacks on the food and beverage industry alone are up significantly in the first half of this year.
Experts told The Food Institute companies cannot just react when the worst happens, but must move aggressively to protect their operations.
“Successful ransomware extortion is shifting away from file encryption that often causes business disruptions to less visible, but more damaging data theft attacks,” Deepen Desai, executive VP of cybersecurity at Zscaler, said. “They are using GenAI to speed up operations, and focusing on stealing more of an organization’s intellectual property, customer information, and other sensitive data to drive payment.”
The ThreatLabz 2026 Ransomware Report found ransom payments were up 5.3% between April 2025 and March 2026 to an average $431,995. There were 1,025 attacks against manufacturers, compared to 605 against the tech industry and 508 against healthcare.
Ransomware Puts Food Production on the Line
The Food and Agriculture Information Sharing and Analysis Center reported attacks on food and beverage companies numbered 227 in the first half of 2026, up 62% from the same period in 2025.
“While some attacks are targeting food and agriculture companies specifically, overall ransomware attacks remain largely opportunistic. Most campaigns scan for exposed systems, acquire access through brokers, and rely on phishing and social engineering to compromise the first vulnerable organization that surfaces. Food and agriculture entities are swept up in that high-volume, indiscriminate activity as much as they are deliberately singled out,” the State of the Threat, report said.
“I’ve seen production stop not because equipment failed, but because teams could no longer trust control systems, batch records, or quantify data,” Oscar Calderon, operational technology cybersecurity governance, risk, and compliance leader at IBM, told Industrial Cyber.
“Even short outages can create waste, missed deliveries, and broader supply-chain disruption If monitoring or traceability systems are compromised, companies may hold or dispose of product simply because safe conditions can no longer be verified with confidence. In this sector, trusted operational data is often as critical as the production process itself.”
Take the case of Coca-Cola’s Fairlife division. Coca-Cola disclosed in a Security and Exchange Commission filing in July that its production-related and other systems had been targeted in a ransomware attack that forced it to suspend production but insisted product quality and safety had not been affected.
“Paying more ransoms is not the solution,” Kevin Bocek, chief product officer at Corsha, told FI. “Manufacturers must move on from just passive monitoring and keeping an inventory. We need active defenses that authenticate and authorize everything that runs on the manufacturing floor.”
Once a system has been breached, Bocek added, the affected sector must be quarantined to keep the damage from spreading further.
How Food Makers Can Stop Ransomware Attacks
Jeff Olejnik. responsible for the leadership, growth and development of Wipfli’s cybersecurity services practice, said food companies should separate their food production systems from other corporate networks so that phishing emails have less chance for shutting down operations.
“Attackers are increasingly using AI to coordinate attacks at much greater speed, so companies need to invest in AI-enabled security operations that can detect and respond to these threats at machine speed,” Olejnik said. “Around-the-clock monitoring is important, but the ability to respond quickly is just as critical. Manufacturers should also regularly test backups of critical systems and data so they can recover if an attack succeeds.”
Cliff Steinhauer, director of information security and engagement at National Cybersecurity Alliance, said manufacturers with a lot of physical, connected machinery, need to continually evaluate risk.
“It’s really important to ensure limited access to those systems, restrict remote access to only as-needed, and close open access “doors” to your environment. Monitoring those systems and keeping them separate is a highly effective way to ensure that if ransomware hits part of your network, you know your machinery can continue to function,” Steinhauer said.
Interestingly, the methods for gaining access are not new. The Zscaler report found the attackers use a combination of spam and vishing (voice phishing) targeted at manager-level employees and senior-level executives who have the greatest access to processes and information. The scams accounted for 62% of the successful attacks, the report found.
Trusted tools like Microsoft Teams and Quick Assist have been turned into gateways.
Lewis Barry, principal security architect at inforcer, told FI security teams need to watch for activity that “falls outside the organization’s agreed data perimeter. If an attack does occur, understanding which identities have been compromised and what those users had access to becomes critical to assessing the organization’s exposure. Strong identity and access controls aren’t just about prevention. They can also help limit the potential impact when an account is compromised.”
The Food Institute Podcast
What does loyalty look like for grocery retailers in an era of AI, hyper-personalization, and increasingly distracted consumers? Loyalty expert David Ciancio joined The Food Institute Podcast live from Groceryshop 2026 to discuss how retailers can move beyond discounts and points to build programs that earn customer loyalty, improve the shopping experience, and serve as a true engine for growth.
——————————————————–
Click Here For The Original Source.
