Ransomware attacks on food and agriculture industry have doubled in 2025

SAN FRANCISCO – Ransomware gangs have long targeted the food and agriculture industry, but seemed to have ramped up attacks in 2025.

Jonathan Braley, director of cyber information sharing organization Food and Ag-ISAC, spoke at the RSA Conference on Thursday and warned of not only the increase in ransomware incidents but the continued lack of visibility into the full scope of the problem. 

“A lot of it never gets reported, so a ransomware attack happens and we never get the full details,” he told Recorded Future News on the sidelines of the conference. “I wish companies would be more open in talking about it and sharing ‘Here's what they use, here's how we fixed it,’ so the rest of us can prevent that.”

The uptick began in the fourth quarter of 2024 and continued into 2025, with the increases largely attributed to Clop’s exploitation of a popular file sharing service. But Braley noted that even when they took out the attacks attributed to Clop, groups like RansomHub and Akira were still continuing to attack the food industry relentlessly. 

The Food and Ag-ISAC obtained its numbers through a combination of open-source sites, dark web monitoring, member input and information sharing between National Council of ISAC members.

The industry saw 31 attacks in January and 35 in February before a dip to 18 attacks in March. 

The 84 attacks seen from January to March were more than double the number seen in Q1 2024.

There have been multiple high-profile incidents impacting the industry in recent weeks, including a March attack on South Africa’s largest chicken producer that cost the company more than $1 million and another on the largest dairy processing plant in southern Siberia.

The report notes that industries like food, agriculture and manufacturing typically face ransomware attacks because they tend to have more legacy equipment and industrial control systems — making them easier targets. Tight supply chains and just-in-time delivery models make food and agriculture organizations appealing ransomware targets, they added.

Braley noted that another concerning finding was ransomware’s share of the overall attack landscape in the industry. Ransomware now accounts for 53% of all actors attacking the food industry.