The Big One: Cyberattack that could cripple food and drink

Food and beverage, cyberattacks, and ‘The Big One’ – summary

• Cyberattacks on food and beverage companies are rapidly intensifying worldwide
• Ransomware remains the most disruptive threat causing major operational shutdowns
• Legacy systems and interconnected supply chains create severe vulnerabilities for attackers to exploit
• Silent data manipulation can distort records and compromise safety without detection
• Industry resilience demands stronger cybersecurity, supplier vigilance, and modernised systems

Cyberattacks against the food and beverage industry are intensifying, leaving suppliers, manufacturers and retailers scrambling to keep up.

Over the past decade, criminals have unleashed a wave of assaults – shuttering plants, disrupting logistics, emptying shelves, and crippling online commerce.

Some of the worst include the 2020 attack on the Campari Group, resulting in stolen financial and personal data, IT shutdowns, and around eight days of business disruption across Campari’s global operations. It only ended when the company agreed to a $15m (€13m) ransom – one of the highest ever paid.

The 2021 strike on JBS Foods – the world’s largest meat processor – was another major hit to the industry, shutting down operations across the US, Canada, and Australia.

These incidents reveal an unsettling truth – the food and beverage system is dangerously exposed to hackers.

Highly automated production lines, sprawling global supply chains, and legacy operational technologies have created an ideal environment for cybercriminals seeking maximum disruption with minimal effort.

Worse still, experts warn that ransomware operators are evolving quickly, now employing double‑extortion tactics, exploiting unpatched vulnerabilities, and infiltrating interconnected SCADA (Supervisory Control and Data Acquisition) and OT (Operational Technology) systems that were never built with cybersecurity in mind.

All this is leading experts to fear what’s coming down the road. What they’re now referring to as ‘The Big One’.

But what is The Big One? What happens when it hits? And how can industry defend against it?

What is The Big One

The Big One isn’t just an isolated cyberattack on a single company or even an entire sector of the industry. It’s the nightmare scenario where interconnected systems fall one after the other.

It doesn’t just shut down a handful of plants, it cripples a major multinational, fractures supply chains, empties supermarket shelves, and triggers cascading economic and social consequences.

“The Big One for the food and beverage sector won’t be one single event,” says Richard Werran, global director of consumer, retail and food at the British Standards Institution (BSI). “It’s likely to be a combination of simultaneous events including partial or full production shutdowns, contaminated products and supply chain disruption, impacting consumer safety, business continuity and brand trust.”

The most probable starting points, he explains, are where digital concentration and operational leverage are greatest, like manufacturing production.

And right now, the industry is dangerously exposed, with legacy systems connected to modern networks, creating weak points that criminals can capitalise on.

“We’ve already seen cases where ransomware has halted processing and packing facilities globally,” says Werran.

And the fragility of the system is further exposed by the fact he believes chilled distributors could be a significant target. A shutdown at this stage could result in the rapid spoilage of stock fundamental to food security.

Then there are the ingredient suppliers, packaging houses, contract labs, cold-chain monitoring firms, and small SaaS (Software as a Service) providers. “They may not be the first domino, but they are powerful amplifiers.”

Most likely form of attack

“Ransomware remains the go-to weapon for determined cybercriminals,” says Werran.

They’re also, he says, the most likely to have the highest impact on consumer safety, business continuity and brand trust. “Encrypting planning, labelling, warehouse management systems, transport, or retail systems forces plants and warehouses offline, even when physical assets remain intact.”

But the threat extends beyond ransomware, with attackers increasingly exploiting a range of vulnerabilities across both IT and OT environments.

Phishing and social engineering remain common entry points, allowing criminals to gain initial access to corporate networks. Unpatched legacy systems and ageing software widen the attack surface, making it easier for attackers to penetrate critical operations. Poorly secured remote‑access points, especially exposed RDP (remote desktop protocol) ports, are another frequent target, enabling criminals to bypass perimeter defences and move deeper into operational systems.

Attacks going unnoticed

Cyberattacks rarely start with a bang. They creep in disguised as tiny glitches.

“At first, it may look like everyday operational ‘noise’,” says BSI’s Werran.

A plant could report IT issues connected to printing labels or access formulations, a co-packer could stop taking orders for a few days while they fix some systems, a logistics provider could miss a series of deliveries and might blame traffic, drivers, or weather, and at the same time the quality team could notice data gaps – this could go on for days or even weeks.

“Organisations might only become aware when patterns emerge – several plants down for days, multiple suppliers affected, or empty shelves reported," says Werran.

And, if the attack includes data manipulation, it could take longer for organisations to be alerted to it, as systems are still effectively operational.

Assessing risk

“Data‑integrity assaults on operational technology, IoT sensors and safety systems should all be considered when assessing risk," says BSI’s Werran. “Here, the aim of an attacker would be to alter reality.”

Sensor values could be tweaked, alert thresholds nudged, AI models for spoilage or anomaly detection gently retrained, lab and environmental records subtly altered, pasteurisation temperatures logged as ‘achieved’, cold stores appear ‘tolerated’ when they sit just outside, allergen cleaning validation records ‘success’ when residues remain – the list goes on and on.

“Add in a compromised supplier ERP (enterprise resource planning system) or quality platform distributing falsified records to multiple customers, and you have the beginnings of a sector-wide trust challenge,” says Werran.

And one of the biggest risks of all is that the industry simply doesn’t seem to be taking the threat seriously enough.

“Whilst we’re beginning to see organisations taking action to prevent cyberattacks, and de-risk their business, it’s vital that every organisation throughout the supply chain – big or small – considers their cyber security risk," says Werran. The work we undertake today to strengthen the weakest links in our supplier network, may be the only defence against a serious incident escalating into a systemic crisis."

Strengthening the defences

The threat of cyberattacks is no longer theoretical. They’re happening somewhere in the world every single day, and the industry simply can’t afford to treat the risk as a background concern.

Food and beverage businesses operate in one of the most interconnected, time‑critical supply chains in the world – that makes every weak link an entry point for disruption.

To withstand The Big One, companies must harden their systems now – replace or isolate legacy technologies, patch relentlessly, strengthen segmentation between IT and OT, and demand the same vigilance from every supplier, contractor, and service provider in their network.

Cyber resilience must become as fundamental as food safety, because the work done today to close gaps, test defences, and build stronger digital foundations may be the only barrier preventing a single breach from spiralling into an industry‑wide crisis.