Australian food manufacturers have spent the last decade hardening their plants against physical contamination: metal detectors, allergen segregation, environmental swabbing, pest control. Yet the contamination event most likely to stop a line in 2026 doesn't arrive on a pallet. It arrives in an inbox.
Since 30 May 2025, the Cyber Security Act 2024 has required any business with an annual turnover of AUD $3 million or more to report a ransomware or cyber extortion payment to the Australian Signals Directorate (ASD) within 72 hours. After a six-month "education-first" grace period, the Department of Home Affairs moved to active compliance from January 2026. For the thousands of mid-tier food and beverage manufacturers that sit above the $3 million threshold, cyber resilience has quietly shifted from an IT preference to a legal obligation.
This guide explains what the law actually requires, why food plants are such attractive targets, and the practical controls that protect your production schedule, your recipes and your retailer relationships.
Why Food Manufacturers Are Prime Ransomware Targets
Attackers choose victims based on one question: how quickly will they pay? Food manufacturing scores alarmingly high.
- Perishability creates urgency. Every hour a plant is offline, chilled and fresh product edges closer to the bin. Attackers know a dairy, bakery or meat processor can't "wait it out" for a fortnight.
- Retailer penalties compound losses. Missed delivery windows to Coles, Woolworths, ALDI or export customers trigger short-shipment fines and damage scorecards that took years to build.
- Operational technology (OT) is old and connected. PLCs, SCADA systems and HMI panels that were never designed for internet exposure are now networked to ERPs and remote-support vendors.
- Valuable intellectual property. Recipes, specifications and supplier pricing are exactly the data that "double extortion" groups threaten to leak.
The industry has already seen what this looks like. Global meat processor JBS paid an US$11 million ransom in 2021 after an attack that halted beef processing across Australia, the US and Canada. Closer to home, Lion – one of Australia's largest beverage companies – was hit by ransomware twice in mid-2020, disrupting brewing and dairy operations and causing beer shortages in some venues.
The Cost of Cybercrime to Australian Business
The ASD's Annual Cyber Threat Report 2023–24 recorded more than 87,400 cybercrime reports – roughly one every six minutes. The average self-reported cost of cybercrime per report rose across every business size:
| Business size | Average cost per cybercrime report (FY24) | Change on prior year |
|---|---|---|
| Small business | ~$49,600 | ▲ 8% |
| Medium business | ~$62,800 | ▲ 35% |
| Large business | ~$63,600 | ▼ 11% |
Source: ASD Annual Cyber Threat Report 2023–24.
These figures capture direct financial losses only. For a food manufacturer, the real bill includes spoiled stock, overtime to recover, retailer fines, forensic investigators, legal advice and – increasingly – the reputational fallout of a public breach.
What the Cyber Security Act 2024 Actually Requires
The Cyber Security Act 2024 is Australia's first standalone cyber law. Its ransomware provisions, set out in Part 3 and the Cyber Security (Ransomware Payment Reporting) Rules 2025, are narrower than many people assume – but the details matter.
| Requirement | What it means for a food manufacturer |
|---|---|
| Threshold | Applies if your annual turnover is $3M+, or you are responsible for a critical infrastructure asset under the SOCI Act. |
| Trigger | A ransomware or extortion payment is made by you, or on your behalf (e.g. by an insurer or incident responder). |
| Deadline | Report to ASD within 72 hours of making the payment or becoming aware of it. |
| Payment types | Includes cryptocurrency, cash and non-monetary benefits such as goods or services. |
| Not required | Reporting a demand you refused to pay (though voluntary reporting via cyber.gov.au is strongly encouraged). |
| Information to provide | Details of the incident, the demand, the payment, and communications with the attacker. |
Two points are frequently overlooked:
- Food and grocery is a critical infrastructure sector. Under the Security of Critical Infrastructure Act 2018, large food and grocery entities can carry additional obligations, including risk management programs and mandatory incident reporting even where no ransom is paid.
- Your insurer paying counts. If your cyber insurer or a negotiator pays on your behalf, the reporting obligation still sits with you.
The Hidden Weak Point: Your Data Lives Everywhere
When incident responders investigate food manufacturing breaches, they repeatedly find the same pattern: critical production data scattered across shared drives, emailed spreadsheets and personal laptops. Recipes live in one Excel file, specifications in another, supplier certificates in someone's inbox, and costings on a desktop that hasn't been backed up since 2023.
That sprawl creates three serious problems:
- A larger attack surface. Every copy of a sensitive file is another opportunity for it to be stolen or encrypted.
- Slow recovery. If your "master" recipe sheet is encrypted and the backup is three months old, you can't confidently produce, label or cost product until it's rebuilt.
- Compliance gaps. Allergen declarations, NIPs and spec sheets reconstructed from memory are a recall waiting to happen.
Centralising recipes, specifications, supplier documents and batch records in a single, access-controlled, cloud-hosted system with automatic version history is one of the most effective – and most underrated – cyber controls a food business can adopt.
A Practical Cyber Resilience Checklist for Food Plants
The ASD's Essential Eight remains the best baseline for Australian businesses. Below is how it translates to a food manufacturing environment.
| Control | Practical application in a food plant | Priority |
|---|---|---|
| Multi-factor authentication | Enforce MFA on email, ERP, remote access and any cloud recipe or QA platform. | Critical |
| Regular backups | Daily, offline or immutable backups of recipes, specs, batch records and OT configurations – tested quarterly. | Critical |
| Patch applications | Keep ERP, browsers, PDF readers and office software current within 2 weeks of release. | High |
| Patch operating systems | Isolate legacy HMI/SCADA PCs that can't be patched onto a segmented network. | High |
| Restrict admin privileges | Line supervisors don't need domain admin rights; separate admin accounts from daily logins. | High |
| Application control | Prevent unknown executables from running on production-floor terminals. | Medium |
| Restrict Office macros | Block macros from the internet – a common entry point via "invoice" or "spec sheet" attachments. | Medium |
| User application hardening | Disable unneeded browser features and legacy plugins. | Medium |
Beyond the Essential Eight
- Segment IT from OT. A phishing email opened in accounts should never be able to reach the PLC controlling your retort or spiral freezer.
- Audit remote vendor access. Equipment suppliers often have permanent VPN or TeamViewer access. Make it time-limited and logged.
- Write a ransomware playbook before you need it. Who decides whether to pay? Who calls ASD within 72 hours? Who notifies retailers and the OAIC if personal data is involved?
- Run a tabletop exercise. Walk your leadership, QA and production teams through a simulated Friday-night encryption event.
Building a 72-Hour Response Plan
| Timeframe | Key actions |
|---|---|
| 0–4 hours | Isolate affected systems; activate incident team; call your cyber insurer and incident responder; switch to manual production records where safe. |
| 4–24 hours | Assess scope (IT vs OT); confirm backup integrity; brief key retailers on potential delivery impact; begin evidence preservation. |
| 24–72 hours | Decide on recovery path; if any payment is made, lodge the ransomware payment report with ASD; assess Notifiable Data Breach obligations under the Privacy Act. |
| Post-incident | Root-cause analysis; rebuild with hardened controls; update the playbook; brief the board. |
Don't Forget Your Supply Chain
Your own network is only part of the picture. Many of the most damaging incidents in food and beverage have started with a third party: a logistics provider whose warehouse management system was encrypted, a packaging supplier whose email was compromised and used to send fraudulent bank-detail changes, or an equipment vendor whose remote-support tool was hijacked.
Practical steps include:
- Add cyber questions to supplier approval. Alongside HACCP certification and allergen questionnaires, ask key suppliers whether they use MFA, maintain offline backups and have an incident response plan.
- Verify bank-detail changes by phone. Business email compromise remains one of the costliest forms of cybercrime in Australia. Never update supplier payment details based on an email alone.
- Know your single points of failure. If one 3PL holds all of your finished goods, what happens if their systems go down for a week?
- Contract for notification. Supply agreements should require partners to tell you promptly if they suffer an incident that could affect your data or deliveries.
Frequently Asked Questions
Does the law make paying a ransom illegal? No. Paying is not prohibited, but government guidance strongly advises against it, and any payment by a business above the threshold must be reported within 72 hours.
We're a $2.5 million business. Are we exempt? From the mandatory payment report, yes – unless you're responsible for a critical infrastructure asset. You're not exempt from being attacked, and voluntary reporting still helps ASD warn others.
Will reporting a payment lead to penalties? The regime includes civil penalties for failing to report, but information provided is subject to limited-use protections designed to encourage transparency.
The Bottom Line
Cyber risk is now food safety risk, supply risk and compliance risk rolled into one. The manufacturers who weather an attack best are those who know exactly where their critical data lives, can restore it quickly, and have rehearsed the first 72 hours.
Batchbase helps Australian food manufacturers move recipes, specifications, allergen data and costings out of vulnerable spreadsheets and into a single secure, cloud-based platform with full version history – so if the worst happens, your production knowledge isn't held to ransom. Book a demo to see how.
References
- Australian Signals Directorate – Annual Cyber Threat Report 2023–24
- Federal Register of Legislation – Cyber Security Act 2024
- Department of Home Affairs – Ransomware payment reporting
- Cyber and Infrastructure Security Centre – Critical infrastructure obligations
- ASD – Essential Eight