INDUSTRY FACT FILE · FMCG, FOOD & BEVERAGES

Threat Landscape: Top Cyber Threats Facing FMCG, Food and Beverages

The 18 most relevant cyber threats, attacks and industry challenges for consumer goods groups, food processors, beverage companies, dairies, cold-chain operators and distributors, and the impact each one has on shelves, food safety, channels and consumers.

FMCG, food and beverage companies attract ransomware groups because every day of stopped orders is lost shelf space and visible to retailers and consumers, which makes victims more likely to pay; they attract fraudsters because trade schemes, supplier, farmer and distributor payments move large sums through portals and email; and they attract data thieves because loyalty apps and CRM platforms hold millions of consumer profiles. The attack surface is wide: plant PLCs and packaging lines, cold-chain IoT, distributor platforms with thousands of external users, retailer and quick-commerce APIs, co-packers and 3PLs, and consumer apps built by agencies.

Public incidents show the pattern. NotPetya disrupted Mondelez in 2017 and led to a US$100 million insurance claim; JBS halted meat plants and paid US$11 million in 2021; Dole shut North American production plants after ransomware in February 2023; Clorox suffered order-processing delays, product shortages and US$49 million in costs after its August 2023 attack; Americold's April 2023 incident hit about 30 per cent of its facilities; United Natural Foods' June 2025 attack disrupted grocery deliveries; and Haldiram's reported Maze ransomware in India in 2020. IBM X-Force ranks manufacturing the most attacked industry for the fifth consecutive year. Indian consumer goods companies run the same platforms and face the same adversaries.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by FMCG, food and beverages segment (Codec Networks assessment).

4.1 Ransomware and the order-to-shelf dependency

Attackers rarely need to touch a filling line to empty shelves. Encrypting ERP, order management and label and dispatch systems removes the ability to take, label and ship orders; lines slow and distributors run dry, as Clorox's shortages and JBS's plant halts illustrate.

• Questions to test: Which order, label, dispatch and invoicing processes depend on ERP? Can we serve distributors manually for a week? Are backups immutable and restores tested? Would EDR and the SOC catch the intrusion before encryption?
• Relevant services: dependency mapping, segmentation, backup and recovery testing, EDR validation, crisis exercises.

4.2 Distributor platforms and scheme integrity

Distributor management systems and sales apps expose scheme logic, claims and secondary sales data to thousands of external users. Weak API authorisation, shared logins and unreviewed approval limits let insiders and partners inflate claims quietly for quarters.

• Questions to test: Have DMS and apps been tested for authorisation flaws? Are approval limits and segregation of duties enforced? Do analytics flag claim anomalies? Are distributor accounts onboarded, reviewed and removed properly?
• Relevant services: portal, app and API testing, claims analytics, access and onboarding reviews, SOC.

4.3 Plants, cold chains and connected devices

Food plants and cold stores combine legacy PLCs, vendor-maintained lines, refrigeration controls and new IoT gateways on networks that were never segmented. An exposed gateway or a phished vendor becomes a path to pasteurisers, batching and temperature records.

• Questions to test: Are plant and cold-chain networks segmented from IT and the internet? Are IoT devices inventoried and hardened? Is OEM access brokered and recorded? Are temperature and batch records tamper-evident?
• Relevant services: IEC 62443 assessment, IoT security assessment, segmentation, remote access brokering, OT monitoring.

4.4 Partners: co-packers, 3PLs and agencies

More production, storage and consumer engagement is run by partners. A co-packer's ransomware, a cold-storage operator's outage or an agency's insecure app becomes your stock-out or your breach, as Americold's and United Natural Foods' incidents and agency-built app leaks show.

• Questions to test: Which partners could stop supply or leak consumer data? Have they been assessed and contracted for security and notification? Are integrations tested and monitored? Do we hold buffers or alternates?
• Relevant services: supply chain assurance programme, contract clauses, integration testing, joint exercises.

4.5 Consumer data, payments and the 6-hour clock

Loyalty apps, D2C stores and CRM platforms hold millions of consumer records and sometimes card data; exposed APIs and scraping turn them into scam campaigns. Incidents must be reported to CERT-In within six hours, disclosed by listed companies and, from May 2027, intimated under DPDP.

• Questions to test: Are apps and APIs tested before launch and each release? Is consumer data minimised and mapped? Do we handle vulnerability disclosures? Is there a playbook covering CERT-In reporting, DPDP intimation and disclosure?
• Relevant services: mobile and API testing, DPDP programme, vulnerability disclosure handling, SOC, playbooks.

• CERT-In: incidents reported within six hours of noticing them; logs available for investigation.
• SEBI LODR: listed companies disclose cyber incidents and data loss in the quarterly corporate governance report.
• FSSAI: incidents that compromise batch, lab or temperature records engage food safety, traceability and recall obligations.
• DPDP: incidents involving consumer, loyalty, distributor or worker personal data trigger breach intimation once provisions commence in May 2027.
• Retailers and partners: contracts require incident notification and can suspend supply or integrations pending assurance.
• Payment partners and insurers: card data incidents trigger PCI DSS investigations; insurers require evidence that warranted controls were in place.

• If ERP went dark tonight, could distributors be served this week?
• Could a distributor or insider inflate scheme claims for a quarter without anyone noticing?
• Who can reach our plant lines, chillers and cold rooms from outside, and is every session recorded?
• Which co-packer, 3PL or cold-storage partner could stop our supply, and have we assessed them?
• Do we know every API behind our loyalty app, and has each been tested?
• Could we detect, contain and report an incident within six hours while keeping food safe?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific organisation. Public incident references are summarised from widely reported events and company disclosures.