✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Food Production
Breach intelligence, attack campaigns, and threat reports targeting the Food Production sector.
Explore Other Sectors
Food Production Threat Reports
AVEVA 2026: Critical ICS Vulnerabilities Put Manufacturing at Risk
In January 2026, AVEVA disclosed seven critical vulnerabilities in its Process Optimization suite, widely used by critical manufacturing and infrastructure sectors worldwide. The flaws, reported by Veracode’s Christopher Wu, include unauthenticated remote code execution, SQL injection, privilege escalation, code injection, and cleartext transmission of sensitive data. Attackers exploiting these vulnerabilities could fully compromise servers, escalate user privileges, access sensitive process data, and potentially undermine operational continuity or safety. Affected versions include all AVEVA Process Optimization releases up to and including 2024.1. These vulnerabilities highlight increasing targeting of industrial control and process optimization platforms, exposing gaps in legacy ICS security. With global critical infrastructure at risk and exploitation methods aligned with broader trends in supply chain and lateral movement attacks, this incident underscores urgent needs for robust security controls, ongoing software updates, and regulatory compliance in the ICS/OT domain.
6 months ago
Kill Chain
Rockwell Automation ICS Devices Exposed by Critical DoS Vulnerability (CVE-2025-9368)
In January 2026, Rockwell Automation disclosed a critical vulnerability (CVE-2025-9368) affecting its 432ES-IG3 Series A industrial Ethernet/IP interface. The flaw, classified as a resource allocation vulnerability (CWE-770), can be exploited remotely to cause a denial-of-service (DoS) condition, rendering the device unresponsive and requiring manual power cycling to restore operations. The vulnerability affects version V1.001 of the device, widely deployed in critical manufacturing environments worldwide. No evidence of active exploitation has been reported as of the initial CISA advisory, but the risk of service disruption in operational technology (OT) networks is significant. This incident underscores the persistent threat posed by resource exhaustion flaws in industrial control systems, as attackers continue to seek low-complexity, high-impact vulnerabilities to disrupt critical infrastructure. With global regulatory focus increasing and ICS-targeted attacks on the rise, addressing resource and availability issues has become a pressing operational and compliance priority for manufacturers and critical infrastructure operators.
6 months ago
Kill Chain
Rockwell Automation DataMosaix SQL Injection Exposes Critical Manufacturing Systems
In January 2026, Rockwell Automation disclosed a critical vulnerability in its FactoryTalk DataMosaix Private Cloud platform affecting versions 7.11, 8.00, and 8.01. Identified as CVE-2025-12807, this SQL Injection flaw allows low-privilege users to execute unauthorized sensitive database operations through exposed API endpoints. While no public exploitation has been reported, successful attacks could significantly compromise critical manufacturing infrastructure worldwide by enabling attackers to access or manipulate sensitive industrial data. The incident highlights ongoing risks to industrial control environments from common vulnerabilities like SQL Injection, especially in products globally deployed across critical infrastructure sectors. With attackers increasingly targeting OT platforms, organizations face renewed urgency to review security controls and ensure compliance with updated defensive best practices.
6 months ago
Kill Chain
Rockwell Automation PLC Flaws Put Industrial Control Systems at Risk in 2025
In December 2025, Rockwell Automation disclosed multiple vulnerabilities affecting its Micro820, Micro850, and Micro870 programmable logic controllers (PLCs). The most critical issues (CVE-2025-13823, CVE-2025-13824) were found in the IPv6 stack and improper handling of malformed CIP packets, potentially allowing unauthenticated attackers to cause denial-of-service conditions. Successful exploitation could lead to systems becoming unresponsive and requiring physical intervention to restore operation. Affected product versions are widely deployed across critical manufacturing sectors worldwide, increasing the risk of operational disruptions. This incident highlights the growing exposure of operational technology (OT) devices to network-borne threats and the importance of promptly securing ICS environments. The prevalence of fuzzing-based vulnerability discovery and dependency on third-party components heighten the urgency to apply vendor-recommended mitigations and adopt defense-in-depth strategies.
6 months ago
Kill Chain
Russian State-Backed Cyberattack Hits US Critical Infrastructure: Lessons from 2024
In 2024, U.S. authorities charged Ukrainian national Victoria Dubranova for her alleged involvement in Russian state-sponsored cyberattacks targeting critical infrastructure across the U.S. and allied nations. Dubranova is accused of collaborating with CyberArmyofRussia_Reborn (CARR) and NoName057(16), groups funded by Russian entities, to launch coordinated distributed denial of service (DDoS) and destructive intrusions. The attacks compromised water systems, food processing facilities, government bodies, and nuclear regulatory sites, resulting in water system sabotage, meat contamination, and emergency evacuations. Investigations revealed evolving tactics and recruitment methods, including custom malware (DDoSia) and incentivized hacktivist participation. This case underscores the escalating threat from state-backed cybercriminals targeting operational technology and essential services. As hacktivists innovate with new tools and social engineering, the risk to public utilities remains severe, prompting a regulatory and industry emphasis on network segmentation, reduced internet exposure, and proactive cyber defense.
6 months ago
Kill Chain
Sandworm Deploys Data Wipers in Sophisticated Attack on Ukraine’s Grain Sector
In early 2024, Russian state-backed threat actor Sandworm orchestrated a series of cyberattacks using multiple data-wiping malware families against Ukraine’s grain sector, education, and government organizations. These attacks involved deploying destructive wiper malware to erase data and disrupt critical operations, with the attackers leveraging lateral movement and advanced intrusion techniques to maximize impact. The campaign caused significant operational downtime, data loss, and posed a direct threat to Ukraine’s primary revenue source, severely impacting the grain production and export processes during a period of geopolitical tension. This incident reflects a trend of increased use of wiper malware in state-sponsored cyberwarfare, targeting national critical infrastructure. Organizations globally are urged to bolster their defenses, as these techniques are being replicated by other well-resourced threat actors beyond the Ukraine conflict.
6 months ago
Kill Chain
Ransomware Attack on Asahi Disrupts Brewery Operations and Beer Supply in 2024
In early June 2024, the Japanese beverage giant Asahi Group was hit by a ransomware attack that significantly disrupted its domestic brewery operations. Threat actors targeted the company's IT systems, crippling order processing and distribution networks for several days, which led to product shortages and impacted supply chain partners and customers. Asahi confirmed that while immediate containment steps were taken and an investigation was launched, operational downtime and order backlogs persisted as recovery efforts continued, demonstrating the real-world impact of cyberattacks on manufacturing and logistics. This incident highlights the rising trend of ransomware gangs targeting critical sectors like manufacturing, exploiting supply chain dependencies to maximize business disruption and force rapid ransom demands. With attackers increasingly prioritizing operational technology and just-in-time industries, organizations must revisit segmentation, east-west controls, and rapid incident response capabilities to keep pace.
6 months ago
Kill Chain
Asahi Ransomware Disruption: Lessons from a 2024 Supply Chain Attack
In June 2024, Asahi Group Holdings, a leading Japanese beverage manufacturer, experienced a disruptive ransomware attack that targeted its IT infrastructure. The incident led to shutdowns across several of its breweries and bottling plants, impacting production and distribution operations in Japan and parts of Europe. Initial investigations revealed that attackers penetrated corporate systems and deployed ransomware, encrypting critical files and demanding payment for restoration. While Asahi swiftly shut down affected systems to contain the threat, the disruption highlighted business continuity vulnerabilities and the risks inherent in operational technology integration. This attack underscores a rising trend in ransomware targeting critical supply chain sectors, particularly food and beverage manufacturing. As threat actors refine their methods and exploit operational downtime pressure, organizations across sectors face increasing urgency to harden east-west traffic security and implement zero trust segmentation to minimize lateral movement risks.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports