Published
Imagine arriving at your nursery on the morning of a major shipment. The plants are ready and the trucks are coming, but nobody can open the order system, print shipping labels or confirm which customer gets which load.
Ransomware can create exactly this kind of disruption by locking access to business systems and records. For farms, cooperatives, greenhouses and horticultural businesses, recovery has to account for crops, customers and delivery windows that cannot wait until next week.
Agriculture ransomware is rising across the food supply chain
The Food and Ag-ISAC’s August 2026 State of the Threat report recorded 227 food-and-agriculture ransomware incidents through July 2026, up 62% from the same period in 2025. It reported 295 incidents for all of 2025, a 29% increase over 2024.
The figures span the food-and-agriculture sector, including producers, processors and other businesses.
The report describes much ransomware activity as opportunistic. Attackers looking for exposed systems, stolen accounts or someone to follow a phishing message can reach a small agricultural business as readily as another company.
Timing can make the consequences worse. In an April 2022 warning about agricultural cooperatives, the FBI identified attacks around planting and harvest. Some victims halted production; others lost administrative functions. Both outcomes matter when customers need seed, fertilizer, storage or deliveries on schedule.
An office attack can become an operational outage
Agriculture cybersecurity needs to cover the office systems that keep orders, deliveries and payments moving. Losing those systems can interrupt work even when tractors and irrigation equipment remain operational.
These examples show where an outage could reach daily operations:
| Operation | System or information lost | Work that could be interrupted |
|---|---|---|
| Farm or agricultural retailer | Supplier accounts, purchasing records or email | Ordering inputs and confirming deliveries |
| Grain business or cooperative | Scale tickets, receiving software or customer records | Accepting loads and reconciling deliveries |
| Nursery or greenhouse | Availability lists, customer orders or label software | Picking, labeling and shipping plants |
| Produce grower or packer | Lot records, shipping documents or buyer communications | Releasing and routing shipments |
Ask the people doing this work which missing login, file or application would stop them first. Use their answers to set recovery priorities. Our agribusiness cybersecurity checklist helps turn those priorities into checks before planting, harvest or seasonal ordering.
Horticulture cybersecurity must account for living inventory
A greenhouse or nursery needs to keep plants in the right conditions while continuing to take orders and ship them. Its security and recovery plans should cover both.
For businesses using connected equipment, include irrigation, environmental controls, remote monitoring and vendor support accounts. NC State Extension’s farm water-system guidance specifically includes greenhouse watering and environmental controls among systems owners should review.
For your own operation, establish three things with the equipment supplier:
- Local operation: What continues working if the internet connection, cloud account or office network is unavailable?
- Support access: Who can connect remotely, how is access approved, and who can end it?
- Recovery: Where are controller settings and configurations backed up, and who knows how to restore them safely?
Have your provider confirm how each system is reached, including whether any access is public. Coordinate updates and network changes with the people responsible for safe operation. If you rely on temperature-controlled storage, use our refrigeration-controller security guide to prepare questions about remote access, support and fallback monitoring.
Protect the paths into the business
Prioritize business email, administrator accounts and remote support. Require multifactor authentication where supported, remove former employee and vendor accounts, and ask your IT provider to identify internet-facing remote access that needs attention.
The FBI, CISA and Australian cybersecurity authorities recommend MFA, timely updates, recovery planning and offline backups in their joint ransomware guidance. Ask your provider to show which sign-ins require MFA, who still has access and when recovery was last tested.
Give employees a clear way to report unexpected requests, including after they have clicked. Practice situations they might face: an equipment technician asking to install a support tool or a supplier document requiring an unfamiliar sign-in. Make checking with a trusted contact part of the normal workflow.
For the wider set of everyday safeguards, use our agriculture cybersecurity best-practices guide.
Agriculture ransomware training and phishing simulations
A practical agriculture ransomware training plan should help employees recognize suspicious sign-ins, unexpected documents and fake support requests, then report them promptly. Use the situations your farm office, nursery or greenhouse team actually handles.
SYB’s Managed Phishing Testing & Staff Training puts agreed scenarios into authorized email campaigns, with short follow-up learning, completion tracking and a dated report. Examples to discuss for your team include:
- Supplier documents: verify an unexpected order, invoice or shared-file sign-in through a known contact.
- Equipment support: confirm the technician and support request before granting remote access.
- Account alerts: check a supposed mailbox or supplier-portal warning through the normal sign-in route.
Review campaign interactions, reporting behavior and training completion with management. Use the results to choose the next lesson and reinforce a clear reporting process.
For regular practice between campaigns, our agriculture cybersecurity training offers short weekly challenges on supplier payments, equipment deposits and vendor support. For an ongoing combination of simulations, learning and progress reviews, ask about the Managed Human-Risk Program.
Test whether a backup can restore a working day
A backup is useful only if you can recover the records and software needed to resume work.
Choose one essential workflow and ask your provider to demonstrate recovery in a safe test environment. For a nursery, that might mean restoring the order database, opening it in the required software and producing a usable picking list. Record how long it takes and what else is needed, including licenses, passwords, printers and specialist support.
Keep a recovery copy protected from the accounts and systems an attacker might compromise. The FBI’s ransomware guidance recommends securing backups separately from the computers and networks they protect, alongside a business continuity plan.
Decide how much recent work you could afford to lose and how you would reconstruct missing orders. Ask how you would recover if the backup provider itself were unavailable; our guide to backup-provider risk explains why that belongs in the plan.
Run a 20-minute outage exercise before the busy season
Bring together the owner, an operations employee, the office lead and your IT contact. Use this scenario:
It is 7 a.m. on your busiest shipping day. Email and shared files are unavailable. A screen demands payment. Your next delivery arrives in an hour.
Work through five decisions:
- Who checks immediate risks to people, plants, livestock and temperature-sensitive products?
- Which work can continue safely, and who authorizes the fallback procedure?
- Where are customer, supplier, equipment-support and incident-response contacts kept outside the affected systems?
- Who contacts technical responders and the cyber insurer, if applicable?
- What must be recovered first, and how will you know it is safe to resume?
Write down the missing answers, assign an owner and set a completion date. Our free small-business incident response plan template includes ransomware response guidance and an agriculture add-on. Use it to capture contacts, responsibilities and recovery priorities, then keep a protected copy available offline.
If an incident occurs, use that plan promptly. Preserve the ransom message and relevant records, involve qualified technical help, and coordinate containment with operations staff so equipment remains safe. Report the incident to the FBI through IC3. Paying does not guarantee recovery.
Find the gaps before the next urgent delivery
Start with the accounts, records and access paths that could interrupt essential work. Securing Your Business’s Business Security Baseline reviews agreed safeguards around business email, Microsoft 365 access, endpoint protection, backups and incident readiness. You receive prioritized findings and clear next steps for you and your IT provider.
For a free starting point, our Zero-Access Exposure Review™ checks public signals around your business email, domains, websites and internet-facing services. No passwords or internal access are required. The Baseline reviews agreed internal safeguards; equipment controls and hands-on recovery testing require a separate scope.
Related resources
Prepare your agriculture team before the next suspicious email
Give farm, nursery and greenhouse staff practical ransomware awareness training and realistic phishing exercises. SYB manages authorized simulations, follow-up learning and reporting around your team’s workflows.