Australia’s food supply is particularly vulnerable to cyber-attacks, warns the director of a national cybersecurity firm, as he calls on the industry to raise its standards on the anniversary of the JBS ransomware hack.
Most important points:
- The head of a national cybersecurity firm warns that Australia’s food supply is particularly vulnerable to pandemic-scale hacking and shutdowns
- The food industry has been added to Commonwealth’s list of critical industries after a successful attack on Australia’s largest meat company
- Five Eyes Security Alliance Says Russian-Backed Hackers Are Targeting Countries Helping Ukraine
JBS Foods, the world’s largest meat processor, was held last year by Russian hackers for $11 million as a ransom.
The cyber attack shut down the company’s global operations for five days, including several Australian slaughterhouses.
Claroty’s Australian Regional Director Lani Refiti said Australia’s entire food and drink supply chain is “uniquely vulnerable” to further attacks.
“It’s happening,” Refiti said.
“It’s not a question of ‘if’ a major attack will take place in the Australian food and drink sector, it’s a question of ‘when’.”
He said there would be food shortages if there were another incident like JBS.
Laws were passed months after the JBS hack to list food and drink as a: critical national industry†
They have led to the introduction of mandatory cyber incident reporting and stricter cybersecurity obligations for assets of national importance.
But Mr Refiti said leading supermarkets, food distributors and processors are still much less safe than other industries.
“If you look at critical infrastructure like financial services, power, water — food and drink is at the bottom of the list,” he said.
Russian-backed hacking threat
The Australian Cyber Security Center said cybercrime rose 13 percent last fiscal year, with self-reported losses totaling $33 billion.
About a quarter of the 67,500 cybercrime reports the agency received last year related to Australia’s critical infrastructure.
“Significant targeting, both nationally and globally, of essential services such as healthcare, food distribution and energy sectors has underlined the vulnerability of critical infrastructure to significant disruptions in essential services, lost revenue and the potential for damage or loss of life.” the center’s report for 2021 reads.
Refiti said the spike in cybercrime has accelerated since Russia’s invasion of Ukraine.
He said there had been much more coordination between countries and cybercriminals in the past three to five years.
“Threat intelligence tells us that these groups are supported or given a safe haven by the Russian government.”
The center partnered with the US, UK, Canadian and New Zealand cybersecurity authorities last month to: give a public warning that Russian state-backed hackers targeted the critical infrastructure of “countries and organizations providing material support to Ukraine”.
Animals, food in danger
The fragility of Australia’s food supply was made abundantly clear during the pandemic as shortages of some products prompted panic buying of many others.
Elizabeth Jackson, a senior supply chain and logistics lecturer at Curtin University, said a cyberattack could pose more problems than empty supermarket shelves.
A Woolworths spokesperson declined to be interviewed, saying only that “cybersecurity is a critical part of our risk management framework and we welcome the new legislation that will help create a consistent standard for cybersecurity protocols across the wider supply chain”.
JBS Foods did not respond to requests for comment.
The JBS attack was one of several successful hacks targeting Australia’s food supply.
Lion, one of Australia’s largest milk and beer processors behind brands such as XXXX, Tooheys, Pura and Masters milk, was hacked and stopped production in 2020.
Toll Group, one of Australia’s largest food distributors, was hacked and shut down twice in 2020.
“Anything three weeks plus would have serious consequences” [food] shortages,” said Mr Refiti.
“These companies are absolute targets,” said Dr. Jackson.
Technology is available
The Australian Cyber Security Center listed a range of attack types in its warning to critical industries “including destructive malware, ransomware, DDoS attacks and cyber espionage”.
Mr Refiti said malware attacks were a common way for hackers to extort ransoms and shut down entire businesses.
“All it takes is one or two people in an organization to open an infected file and then it spreads like wildfire in an infected organization.”
However, he said there were ways to improve safety.
“The controls to fight ransomware have been in place for 10 years,” he said.
“It’s not hard to do from a process or technology perspective.”
He said the financial sector had tightened its security.
“It took a lot of thefts of credit cards and personal information before regulators stepped in and the government started holding these organizations accountable,” he said.
“I think the same will happen in the food and beverage sector.”
#Major #supermarkets #uniquely #vulnerable #Russian #cyberattacks #increase