Ransomware gang strikes Iowa agriculture business New Cooperative, the latest hack on food supply chain

The hack follows this summer's ransomware attack on meat supplier JBS.

The BlackMatter ransomware gang has struck an Iowa agricultural business, New Cooperative, and is demanding a $5.9 million ransom.

Several security researchers first called attention to the hack on Monday, and the company confirmed that it had been hit with a cyberattack and shut down its systems in response. It’s another big hit against the agriculture industry, following the May ransomware attack on JBS by REvil, a gang that researchers said has ties to BlackMatter.

“Out of an abundance of caution, we have proactively taken our systems offline to contain the threat, and we can confirm it has been successfully contained,” New Cooperative said in an emailed statement. “We also quickly notified law enforcement and are working closely with data security experts to investigate and remediate the situation.”

New Cooperative is a grain collective based out of Fort Dodge. In negotiations dated Sept. 19 and posted online, a person speaking on behalf of the company said the attack would cause severe problems in the food supply chain.

“We are critical infrastructure – we [sic] intertwined with the food supply chain in the US,” they wrote. “If we are not able to recover very shortly, there is going to be a very very public disruption in the grain, pork and chicken supply chain. About 40% of grain production runs on our software, and 11 million animal feed schedules rely on us.”

The negotiator for New Cooperative said that the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency would be demanding answers within 12 hours, and called attention to BlackMatter’s claim that it doesn’t target critical infrastructure. BlackMatter’s negotiator answered, “You do not fall under the rules.”

The firm did not immediately respond to request for comment. CISA referred questions back to the company. The federal government has labeled “food and agriculture” as one of the nation’s critical infrastructure sectors.

Dmitry Smilyanets, an analyst at threat intelligence company Recorded Future, said the attack “looks bad.”

“The threat actors claimed to have stolen data related to the complete line of precision tools for guidance, steering, and controlled input usage,” he said via email.

The negotiator told BlackMatter that “The impact of this attack will likely be much worse than the pipeline attack for context,” referring to the Colonial Pipeline ransomware attack in May, which spurred a fuel panic.

The company said in its statement that it was “treating this matter with the utmost seriousness, and we are using every available tool and resource to quickly restore our systems.”

Allan Liska, another analyst at Recorded Future, said he expected CISA and the U.S. Department of Agriculture would be involved in responding to the attack.

Tonya Riley contributed reporting.

Updated, 9/20/21: To include comment from New Cooperative.

Corrected, 9/21/21: To fix the spelling of Dmitry Smilyanets’ name.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure