Meat processing giant JBS paid out an $11 million ransom following a cyber attack, according to reports. Most of its meat packing facilities, including the one in Alberta, remained idle for a few days. For years, most of us linked the concept of cyber attacks with IT companies, governments, and media. Experts have been warning the food industry for years about the threat of becoming an active target for hackers. What was once purely academic has now become a reality.
Until now, efforts to counter cyber attacks in the industry have been timid, at best. At the very least, it was not an openly discussed topic amongst industry leaders. The fact that the world’s largest processor of beef and pork was targeted by hackers earlier this month is certainly a cause for concern and can serve as a major wake-up call. We can easily imagine that other companies like Cargill, Olymel, Maple Ridge Farms, McCain, Maple Leaf, Lassonde, Sysco, Loblaw’s, Sobeys, Metro, and other major players could also become a target.
Managing systemic risks is not new to the food industry – far from it. Threats related to food safety, food fraud and of course, pandemics have been considered critical issues for years. The focus has always been on the integrity and quality of ingredients and products coming in and out of facilities. The pandemic made companies focus more on worker safety and how humans play a role in manufacturing the food we consume every day. It has always been about keeping everyone safe, starting with consumers. Cybersecurity goes to the core of the operational nature of a company as it goes beyond the food we eat. Ransoms aren’t intuitively compatible with how food companies manage risks.
The food industry is a critical piece of our economy, and changes in the industry are making it a more likely target in the future. Operations are adopting high-tech innovations like drones, GPS mapping, soil sensors, autonomous tractors, artificial intelligence and more. These changes in the industry are needed, but they can also make it a primary target. As the industry becomes more data-driven, it will also become more vulnerable to cyber attacks. On the other side of the digital spectrum, many food operations still use outdated operating systems like Windows 98. One can only hope that most management teams in the food industry are reviewing their IT systems and figuring out how vulnerable they are to cyber attacks.
For consumers, the potential consequences of these attacks are not trivial. Disruptions can lead to food shortages and higher prices at retail. Or worse, cybersecurity breaches could lead to procurement issues and inadvertent alterations to ingredients put into the food sold at retail. Ransom requests are just the beginning. Evil has no shame, no limits and it can harm a great number of consumers within days, perhaps even hours. The fact that JBS did pay a ransom signaled to perpetrators that it can work. We should expect more attacks to occur in the future.
Virtually no mandatory cybersecurity rules govern the many agri-food businesses that account for close to 20% of the Canadian economy. Some trade groups may have voluntary guidelines, but that would be the extent of it. The Canadian Food Inspection Agency (CFIA) has no material on cybersecurity – not a single mention of this on its website. Its world is often exclusively about pathogens and allergens. Its focus requires a broader view, now more than ever. For the industry to protect itself, more information sharing mechanisms would be required, and our federal agency should be playing a more active role.
In essence, with the attack on JBS, the food industry has just experienced its own “Tylenol” moment. In 1982, some people tampered with bottles of Tylenol in Chicago-area retail stores and poisoned several people, killing at least seven. Many bottles were laced with potassium cyanide. At the time, bottle packaging practices were not the same and the murderers took the industry completely by surprise. That incident led to significant changes in how bottles were sealed and secured. Hopefully, the JBS incident will also lead to increased security and protection.
