Is Your Farm an Easy Target?

Friday, September 25, 2026

Cybercriminals are exploiting weak passwords & phishing scams

By Mary Loggan

For most Ontario farms, cybercrime still feels like something that happens to banks, governments, or large institutions.

Yet phishing, malware and ransomware are already disrupting farms and agri-food businesses, putting cash flow, sensitive data and trust with suppliers and customers at risk.

As more operations rely on connected equipment, cloud tools and remote access, every login, update and password becomes part of the farm’s risk profile — not just an IT issue.

The concern is rising faster than preparedness. Recent research shows that many producers worry about cyberattacks but still lack basic protections such as multi-factor authentication, tested backups, and incident response plans.

Eugene Ng, MNP’s cyber security leader and a member of the Enterprise Risk Services team in Mississauga, says closing that gap is critical to protecting the business behind the barn.

More sophisticated threats

MNP’s 2025 Cyber Security on the Farm report found that among farms that suffered a cyberattack, the leading causes were phishing, malware, and ransomware.

“Agri-food producers typically operate in a hybrid environment, relying on a combination of on-premises and cloud-based technologies,” Ng explains.

“That means the risks are a little different.”

Office computers, mobile devices, cloud accounting platforms and connected equipment can all create entry points when basic controls are missing.

What has changed most is scale.

“The ability for threat actors and cybercriminals to scale using AI-powered toolsets is a challenge facing every Canadian organization,” Ng says.

The techniques themselves are not new. Fake antivirus pop-ups, fraudulent Windows update prompts, bogus Microsoft support calls and malware hidden in pirated software have been around for years. But the difference now is the quality of the deception.

“Cyber threats have become more sophisticated and harder to detect,” Ng explains.

“Highly targeted phishing campaigns now use polished imagery and professional language, while malware is engineered to evade security controls.”

When combined with AI, cloud infrastructure, and cybercrime-as-aservice ecosystems, those tools allow attackers to launch convincing campaigns at speed and scale, often with less technical expertise than before.

Underneath many of these attacks sits one main goal: credential theft.

“Ultimately, these tactics give cybercriminals multiple ways to steal multi-factor authentication (MFA) passcodes, browser cookies and session tokens.

“Producers really need to protect themselves from malware and credential theft.”

Challenges & blind spots

Ng sees credentials as one of the biggest blind spots on farms.

“Passwords need to be stronger and unique, and MFA is now a must-have rather than a nice-to-have,” he warns.

As attackers become more advanced, many organizations are also moving toward phishing-resistant MFA.

That matters because attackers are increasingly relying on user-driven mistakes to gain access.

Common examples include fake browser updates, malicious ads that redirect users to fraudulent websites and offers for premium or cracked software.

“People are convinced to click or download something.”

Once malware is loaded onto a system, infostealers can capture session tokens — the digital proof that a user has already authenticated.

After a user logs in, the application creates a session token and stores it in the browser as a cookie. On subsequent requests, that cookie is sent back to the application to prove the user is still signed in.

“If a threat actor obtains your valid session cookie, they may be able to impersonate you without knowing your password and without completing MFA.”

When that is layered with a realistic phishing campaign, a fraudulent link found through search engine manipulation, or reused credentials from a previous breach, attackers may have enough information to access farm systems.

Third-party relationships create another growing risk.

“When a supplier’s or customer’s email account is compromised, threat actors can use trusted relationships to target agri-food producers and manufacturers,” Ng says.

“Recently, we’ve seen an increase in Business Email Compromise (BEC) attacks targeting the agri-food sector.”

BEC attacks use compromised accounts, spoofed identities or carefully crafted impersonation techniques to trick employees into authorizing payments, redirecting funds, sharing sensitive data or granting unauthorized access.

Because the messages often appear to come from a known contact, they can be especially difficult to spot.

“By exploiting trust and legitimate business processes, BEC attacks have become one of the most financially damaging cyber threats facing organizations today,” Ng says.

On the infrastructure side, he highlights a few practical priorities.

He says public-facing systems should be protected behind a firewall, and access to on-premises environments should be restricted through a VPN secured with multi-factor authentication. IT and operational technology systems should also be updated regularly.

If farms are unsure how to manage those updates, Ng says they should ask their vendor or IT support provider to enable automatic updates.

He also recommends subscribing to security notifications from key technology vendors so farms are alerted when patches become available.

Protect your operation

To avoid overwhelming producers, Ng uses the 80/20 principle — the idea that roughly 80 per cent of outcomes come from 20 per cent of efforts.

“Farms can focus first on the foundational cybersecurity controls that provide the greatest reduction in risk with the least operational burden,” says Ng, who presented a cybersecurity webinar for the OFA in April (available on the OFA’s OntarioFarms YouTube channel).

At a minimum, Ng says every farm should:

• Use strong, unique passwords and enable multi-factor authentication on email, banking, cloud platforms and other critical accounts.
• Keep computers, mobile devices, connected equipment and software up to date.
• Enable automatic updates where possible.
• Back up essential business and operational data regularly, store a copy separately from the farm’s network and test that it can be restored.
• Use antivirus software and firewalls on connected devices and networks.
• Limit access to sensitive systems and remove accounts when employees or service providers no longer need them.
• Train employees and family members to recognize phishing emails, fraudulent links and unusual payment requests.
• Create a written incident response plan that identifies who to contact, including the farm’s IT provider, cyber insurance provider and legal counsel, and keep an offline copy in case systems cannot be accessed.

“The appropriate controls will vary depending on the size and complexity of the operation,” Ng says, “but these measures provide a practical starting point for reducing cyber risk.”

If a breach is suspected, his advice is immediate and focused.

“Bring in a professional to investigate. If you have cyber insurance, contact them immediately.

“Document timelines and affected assets so the details are clear when speaking with a cyber professional.”

That documentation can help speed up recovery and reduce confusion in the middle of an incident, when time and clarity matter most.

Looking ahead

Over the next few years, Ng expects cyber risk to evolve alongside farm technology.

“Farms will continue adopting more connected equipment, cloudbased technologies and AI-powered tools across administrative, back-office and operational functions.

“As these technologies become more integrated into day-to-day operations, securing them becomes very important.”

He urges agri-food businesses to begin preparing for the next generation of authentication by moving beyond traditional MFA, where appropriate, and adopting phishing-resistant methods such as FIDO2 security keys, passkeys and Windows Hello.

“We will continue to see cybercriminals use AI to make attacks more convincing, scalable and difficult to detect,” Ng warns.

“Farmers should start thinking about strengthening the security of both their systems and their users.”

For small and medium-sized organizations, practical next-steps include enabling built-in endpoint detection and response or antivirus tools, using network monitoring or firewall intrusion prevention features to identify unusual device activity and setting up automated alerts or quarantine measures to respond quickly when suspicious activity is detected.

He says cybersecurity is now part of running a resilient farm business.

“The same discipline that keeps equipment maintained and books balanced can also keep passwords, updates and backups in shape.

“And that may be what keeps the next phishing email or fake update from turning into a costly shutdown,” Ng says. BF

Key Takeaways

• Cyber attacks are already hitting farms through phishing, malware, ransomware and email scams.
• Credentials are a major weak point, so strong passwords and multi-factor authentication are essential.
• Basic cyber hygiene — updates, backups, antivirus and staff training — stops many common attacks.
• As farms adopt more connected and AI-powered tools, cybersecurity must become a core management task. BF