November 14, 2026 Best Practices 9 min read

Farm Cybersecurity in Canada

By Omer Segoly, CISM | Published November 14, 2026

Farm cybersecurity in Canada means protecting payments, office computers and connected equipment at farm operations, greenhouses, food processors, agricultural co-ops and equipment dealers. Public Safety Canada's National Strategy for Critical Infrastructure lists food as one of ten critical infrastructure sectors. The Canadian Centre for Cyber Security's National Cyber Threat Assessment 2025-2026 states that "ransomware is the top cybercrime threat facing Canada's critical infrastructure." The Communications Security Establishment announced that assessment on 30 October 2024. This is informational context (not legal advice).

Why are farms and food businesses targeted in Canada?

Public Safety Canada lists food as one of ten critical infrastructure sectors. The Cyber Centre's National Cyber Threat Assessment 2025-2026, announced on 30 October 2024, states that "ransomware is the top cybercrime threat facing Canada's critical infrastructure" and that it "directly disrupts critical infrastructure entities' ability to deliver critical services." The same assessment says ransomware actors "are almost certainly opportunistic and do not target specific industries."

Critical infrastructure is still attractive, the assessment says, because operators "are perceived as being more willing to pay large ransoms to prevent disruptions to critical operations." It names 2021 ransomware incidents that impacted JBS Foods operations in North America and Australia. The Calgary Herald reported on 1 June 2021 that a ransomware attack idled the JBS beef plant in Brooks, Alberta, on Sunday, 30 May 2021, and that production restarted Tuesday afternoon. CBC reported on 2 June 2021 that some Canadian shifts were cancelled Monday and Tuesday and that the plant had resumed production.

Maple Leaf Foods confirmed on 6 November 2022 a system outage linked to a cybersecurity incident, and said full resolution would "result in some operational and service disruptions." In a statement later published by SecurityWeek and The Record, the company said: "Unfortunately, we know that the people behind this incident were able to gain unauthorized access to some of our data, and they are threatening to release it unless we pay a ransom, which we will not do." SecurityWeek reported that the Black Basta group has taken credit. The company statement does not name a group. The Record reported that all plants continued to operate.

How does payment fraud reach grain sales and supplier invoices?

Agriculture and Agri-Food Canada describes "phishing emails that try to steal your personal data or gain access to your business systems," and says "fraudulent calls and texts are scams designed to deceive you into providing personal information or money." Grain cheques, livestock settlements and supplier invoices leave from the same inboxes. Treat a new bank account as unverified until you call a number you already had on file.

Our guide to business email compromise names the pattern: "Criminals impersonate a real supplier your company already pays, claim the supplier changed banks, and redirect your next payment to a fraudulent account." A grain buyer, a livestock dealer or a feed supplier is that supplier. Do not use a phone number from the email.

What does ransomware do during harvest and at a processor?

On 20 April 2022, the FBI told Food and Agriculture sector partners that "ransomware actors may be more likely to attack agricultural cooperatives during critical planting and harvest seasons." Between 15 September and 6 October 2021, the notification says, six grain cooperatives experienced ransomware attacks. The FBI did not name them. The document says the notification was coordinated with DHS/CISA and USDA.

The same notification says "an attack that disrupts processing at a protein or dairy facility can quickly result in spoiled products and have cascading effects down to the farm level as animals cannot be processed." Agriculture and Agri-Food Canada says ransomware can lock critical systems and data, "halting production, distribution, and supply chain activities," and that such disruptions can lead to "spoilage of perishable goods." Our guide to manufacturing cybersecurity in Canada states the pressure this way: "For a small or mid-sized manufacturer, an attack that encrypts production data or halts a line creates immediate pressure to pay." A food processor that cannot run a line is in that position.

Which connected farm systems and shared computers are exposed?

Agriculture and Agri-Food Canada says a cyber incident can target "production, financial, customer and other data," "wireless sensors," "automated and robotic machinery," "autonomous and semi-autonomous vehicles and equipment," and "heating, refrigeration, lighting and ventilation controls and systems." CSA Group research published in February 2026 describes sensor networks used for "livestock barn and greenhouse environmental monitoring."

The same CSA Group paper describes "GPS-enabled planting and harvesting systems." It also says farm equipment and weather stations "are no less vulnerable to malicious cyber exploits."

The Cyber Centre's Baseline Controls say organizations should "give all users unique individual accounts and minimize or eliminate the use of shared or shared-use accounts." Agriculture and Agri-Food Canada says to avoid the "save password" option on shared computers, and its checklist includes changing default passwords on GPS-enabled devices, "including the passwords of the routers for Wi-Fi network(s) and tractors and other machinery in the field." Our vendor risk guide states the related rule for dealers and software vendors: "Many vendors require some level of access to your systems to deliver their services," and "each of these access points is a potential entry vector if the vendor's own security is compromised."

Which baseline controls should farm cybersecurity in Canada put first?

The Baseline Cyber Security Controls for Small and Medium Organizations are version 1.2. The Cyber Centre intends them for "organizations that have less than 500 employees," and says the aim is to "achieve 80% of the benefit from 20% of the effort." Our guide to the baseline controls describes them as 13 cyber security practices recommended for small and medium organizations.

1. Verify payment changes (BC.6). BC.6.1 says organizations should "invest in cyber security awareness and training for their employees." Include the rule that banking changes are confirmed by a phone call to a known number.
2. Two-factor authentication (BC.5). BC.5.1 says organizations should "implement two-factor authentication wherever possible," and should require it for important accounts such as "financial accounts, system administrators, cloud administration, privileged users, and senior executives." Use it on email, banking and equipment portals.
3. Offline backups (BC.7). BC.7.1 says organizations should "back up systems that contain essential business information, and ensure that recovery mechanisms effectively and efficiently restore these systems from back-ups." BC.7.2 says "long term backups (e.g. weekly backups) must be stored offline."
4. A printed incident plan (BC.1). BC.1.2 says organizations should "have a written incident response plan that details who is responsible for handling incidents including any relevant contact information for communicating to external parties, stakeholders and regulators," plus "an up-to-date hard copy version of this plan." Our guide to building an incident response plan notes why this control comes first: "when an incident hits, everything else depends on having a plan to follow."
5. Default passwords (BC.4). BC.4.1 says organizations should "implement secure configurations for all their devices changing all default passwords, turning off unnecessary features, and enabling all relevant security features." Agriculture and Agri-Food Canada names routers, tractors and other field machinery.
6. Remove accounts when the job ends (BC.12). BC.12.3 says organizations should "remove accounts and/or functionality when employees no longer require these for their tasks." That includes seasonal employees and temporary foreign workers when their work ends.

What personal information duties does PIPEDA put on a farm?

Section 4 of PIPEDA applies to personal information an organization "collects, uses or discloses in the course of commercial activities," and to information about an employee only "in connection with the operation of a federal work, undertaking or business." The Office of the Privacy Commissioner states that "PIPEDA applies to employee information only in connection with a FWUB" and that "PIPEDA does not apply to employee information in provincially-regulated organizations."

Worker files, including temporary foreign worker records, are employee information. A farm that is not a federal work, undertaking or business should not assume PIPEDA covers them. Customer information collected in commercial activity is the separate rule in section 4. The same OPC page says Quebec, British Columbia and Alberta have private-sector laws deemed substantially similar to PIPEDA. Those statutes are separate from PIPEDA and from each other. This article does not set them out. In those provinces, the OPC says PIPEDA only applies to interprovincial and international transactions.

Where PIPEDA applies, OPC breach guidance says organizations must report breaches "that pose a real risk of significant harm to individuals," notify affected individuals, and "keep records of all breaches." The OPC says "the law requires you to keep breach records of all breaches of security safeguards for two years." The Breach of Security Safeguards Regulations say an organization "must maintain a record of every breach of security safeguards for 24 months after the day on which the organization determines that the breach has occurred."

What should you do after a suspected cyber incident?

If a payment may have been redirected, the Canadian Anti-Fraud Centre says to "Report the incident to the financial institution that transferred the money," and to report it to local police. You can report online at reportcyberandfraud.canada.ca or by phone at 1-888-495-8501, Monday to Friday, from 10 am to 4:45 pm Eastern time. The report page says the line is closed on holidays.

Agriculture and Agri-Food Canada tells farming businesses to report a cyber incident immediately to the "Canadian Centre of Cyber Security." If personal information covered by PIPEDA is involved, use the breach test above. This is general information, not legal advice.

Call the bank from a number on a statement, not from the message. Restore from an offline backup and confirm the files open.

One question to ask this week

Ask who can change a supplier's banking details, and when a file was last restored from an offline backup. BC.7.2 says "long term backups (e.g. weekly backups) must be stored offline." BC.7.1 says organizations should ensure recovery mechanisms "effectively and efficiently restore these systems from back-ups." If nobody can answer, start there.

Check your farm or plant against the baseline controls

The free cybersecurity assessment for Canadian businesses states: "Evaluate your organization's security posture against the Canadian Centre for Cyber Security's Baseline Controls. 50 questions, under 30 minutes, completely confidential." It also states: "Your answers stay in your browser and are never transmitted. Progress is saved locally for 48 hours."

The same page says "No signup or email required," and that the information "does not constitute professional cybersecurity, legal, IT, compliance, or risk management advice."

Frequently Asked Questions

Cite This Page

Suggested citation:

Cybersecurity Canada (2026). Farm Cybersecurity in Canada. Retrieved from https://cybersecuritycanada.ca/news/posts/farm-cybersecurity-canada/

Permanent URL: https://cybersecuritycanada.ca/news/posts/farm-cybersecurity-canada/ · Published November 14, 2026