INDUSTRY FACT FILE · AGRICULTURE & AGRITECH

Threat Landscape: Top Cyber Threats Facing Agriculture and Agritech

The 18 most relevant cyber threats, attacks and industry challenges for agribusinesses, seed and agri-input companies, farm IoT providers, marketplaces, warehousing and agri-credit platforms, FPOs and cooperatives, and the impact each has.

Agriculture and agritech businesses face attackers with different aims. Criminal groups use ransomware against cooperatives, processors, input firms and platforms because downtime during sowing, harvest or a payout window creates pressure to pay, and the FBI warned in April 2022 that attacks on agricultural cooperatives may be timed to those seasons. Fraudsters target payment flows, subsidies, loans and warehouse receipts, often by misusing the credentials of officials, field agents, dealers or traders rather than by breaking encryption. Opportunistic attackers scan the internet for exposed gateways, controllers, management interfaces and storage buckets. Competitors and insiders seek breeding data, trial results and pricing. Researchers find flaws in devices and apps, which become public quickly, and vendors and integrators deep in the chain can introduce weaknesses without anyone noticing.

Public reporting shows how these risks have played out. In August 2020 Tamil Nadu reported that officials' login credentials had been misused to register about 5.5 lakh ineligible PM-KISAN beneficiaries in 13 districts, with more than ₹110 crore transferred before the surge was noticed. JBS paid US$11 million in June 2021 to end a ransomware attack that disrupted meat production in North America and Australia. In September 2021 BlackMatter ransomware hit the Iowa grain cooperative NEW Cooperative, with a reported demand of US$5.9 million, and Minnesota's Crystal Valley cooperative was hit days later, both during harvest. At DEF CON in 2021, researchers reported vulnerabilities in web systems of major farm equipment makers, later fixed. As Indian farming moves onto AgriStack, e-NAM, DBT and digital credit, the same patterns of credential misuse, platform flaws and seasonal ransomware apply.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by agriculture and agritech segment (Codec Networks assessment).

4.1 Farm devices, gateways and the cloud broker

Precision farming platforms connect thousands of low-cost sensors, gateways and controllers to one cloud message broker. Default or shared passwords, open management ports, unsigned firmware and brokers that let any device publish to any topic mean that one weakness can expose every farm on the platform. False readings can drive wrong irrigation or spraying decisions, and remote commands can switch pumps and valves. Devices sit in remote fields for years, so weaknesses persist.

• Questions to test: Does every device have unique credentials? Are management ports closed? Is firmware signed and are updates verified? Can one device or farm reach another's data or commands on the broker? Are command rates and ranges limited? Would we notice abnormal readings or commands?
• Relevant services: IoT device and firmware testing, broker and cloud architecture review, device identity design, authorised testing scheduled around field operations and SOC use cases for device anomalies.

4.2 Payment integrations and settlement

Marketplaces, input e-commerce and FPO platforms collect and pay out money through gateways, UPI, bank APIs and DBT-linked flows. The most damaging flaws are logical: trusting a payment callback without checking its signature and amount, processing the same message twice, or releasing payouts before reconciliation. Fraudsters probe these flows quickly, and losses can mount for days before finance teams notice.

• Questions to test: Do we verify the signature, amount and order of every callback? Are duplicate and replayed messages rejected? Do payouts wait for server-side reconciliation? Are bank detail changes verified out of band? Would we notice unusual payout patterns?
• Relevant services: payment integration testing, settlement logic and API VAPT, reconciliation and fraud control reviews, and monitoring of payout anomalies.

4.3 Credentials to public platforms, lenders and partners

Agritech firms, integrators, service centres and cooperatives increasingly hold logins and API keys to scheme portals, registries, lenders and insurers. The 2020 PM-KISAN case in Tamil Nadu showed how misused official credentials can add lakhs of ineligible beneficiaries before anyone notices. Shared accounts, no MFA, weak key storage and no monitoring of who registers or changes records make such abuse easy.

• Questions to test: Who holds logins and API keys to public and partner platforms? Are they named, MFA-protected and reviewed? Are keys stored in a vault? Are unusual volumes of registrations or changes flagged? Do consent records match each data request?
• Relevant services: integration and access control reviews, privileged access management, API key handling reviews, monitoring of registration and change volumes and DPDP consent reviews.

4.4 Agri-credit, field agents and document fraud

Agri-credit platforms originate loans through field agents' tablets and farmer apps, using land records, crop data and warehouse receipts. A phished agent account, an app that stores data on lost devices or a workflow that accepts uploaded documents without checking them at source can turn into fraudulent loans to mule accounts. Lenders and RBI's digital lending rules hold the regulated entity responsible for its partners.

• Questions to test: Do agent accounts use MFA and device binding? Are land, crop and receipt data verified at source rather than from uploads? Are velocity and anomaly rules in place? Is data on agent devices encrypted and wiped when lost? Can we give the lender a complete audit trail?
• Relevant services: mobile app and loan API testing, access and device management review, fraud control reviews, DPDP programmes and incident response for loan fraud.

4.5 Seasonal ransomware at procurement, storage and plants

Cooperatives, agribusinesses and input firms run procurement centres, warehouses, dryers, cold stores and plants whose IT and OT are often flat, reachable through remote access and backed up to shares attackers can reach. The FBI's 2022 warning and the 2021 attacks on US grain cooperatives show that attackers know harvest is when downtime hurts most. Recovery must be possible within days, not weeks.

• Questions to test: Are office, weighbridge, dryer and plant networks segmented? Is all remote access MFA-protected? Are backups offline and tested? Can we buy, weigh, store and pay manually for a week? Is monitoring strengthened during sowing and harvest?
• Relevant services: OT and network assessments, ransomware readiness and backup testing, managed SOC with harvest-season monitoring, tabletop exercises and an incident response retainer.

• CERT-In: incidents reported within six hours of noticing them; logs kept for 180 days in India and available for investigation; CERT-In may issue directions and advisories.
• RBI and lending partners: incidents at lending service providers and loan apps draw in the regulated entity, which may suspend the partnership, demand audits and report fraud under its own obligations.
• Scheme and AgriStack owners: misuse of integrations or credentials can lead to suspended access, recoveries and investigations by state and central authorities.
• WDRA and lenders: incidents affecting warehouse receipts or stock records raise questions under accreditation conditions and pledge agreements.
• DPDP Act: breach intimation and safeguards for farmer and borrower data once provisions commence; SEBI LODR disclosure for listed firms.
• Buyers and partners: processors, exporters, insurers and investors can suspend contracts, demand audits or exercise security clauses after incidents.

• If ransomware struck in harvest week, could we still buy, weigh, store and pay for crops?
• Does every device on our platform have unique credentials and verified firmware?
• Do we verify every payment callback and reconcile before money leaves?
• Who holds logins and API keys to public, lender and partner platforms, and are they protected and monitored?
• Where is our farmer, land and borrower data, and who can reach it today?
• Could we detect, contain and report an incident within six hours, including at night and in peak season?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific organisation, platform or scheme. Public incident references are summarised from official statements and widely reported events. Attack techniques are described only at the level needed to explain defences, and testing of devices, drones and payment systems is described only as authorised testing in agreed windows and controlled conditions.