Ransomware (extortion): Agriculture, Canada
A dairy farm was hit twice by ransomware: after the first attack, it paid a ransom, and the team of researcher Ali Dehghantanha decrypted the systems and got the farm running again.
- Incident · date unknown · Southern Ontario, Canada
- Evidence: one media report
- Ransomware (extortion)
- Devices and control systems
As of
What happened
The farm then declined monitoring; the attackers returned and paralysed the milking robots, the cows’ collar transponders and all connected systems, with a higher demand. The source does not name a robot brand (e.g. Lely) or dead animals.
- Affected
- Company (anonymous)
- Industry
- Agriculture
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- yes / yes
- Data affected
- true
- Bankruptcy
- no
- Entry point
- not stated in the sources
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Help and negotiation; only some insurers pay the ransom, see note
Mostly add-on 6 of 9 business products cover it fully, as an add-on or with limits.
-
Loss of income after an attack
Business interruption, only after the waiting period
Mostly covered 7 of 9 business products cover it fully, as an add-on or with limits.
-
Costs of getting data, software and systems running again
Mostly covered 6 of 9 business products cover it fully, as an add-on or with limits.
-
Property damage caused by an attack
Spoiled goods, damaged machine
Mostly not covered 0 of 9 business products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Anyone who has paid once is often attacked again; after an incident, clean-up and ongoing monitoring are needed.
Sources
- Reducing your farm's cybersecurity risks (opens in a new window) Farms.com · 2024-11-19
«The biggest lesson here: you need proper security monitoring in place even after an attack.»