Iowa farm cooperative hit by ransomware, systems go offline

Credit: Pixabay/CC0 Public Domain

A ransomware attack by the BlackMatter gang forced New Cooperative, an association of Iowa corn and soy farmers, to take their systems offline but it said it created workarounds to receive grain and distribute feed, a person close to the business said.

Member-owned New Cooperative said in a statement that the attack was "successfully contained" and that it had quickly notified law enforcement. It said it took its systems offline out of "an abundance of caution" and was working with data security professionals to quickly remedy the situation. It did not specify when the ransomware was activated.

The attack hit just as Iowa's corn and soy harvesting is getting under way.

Security researcher Allan Liska of Recorded Future said the criminals demanded a $5.9 million ransom for a decryptor key to unlock files they scrambled. He said a sample of their malware was uploaded to a research site either late Friday or early Saturday.

Security researchers believe BlackMatter may be a reconstituted version of the syndicate DarkSide that disrupted the Colonial Pipeline last spring then announced it was disbanding. BlackMatter claims on its darkweb site not to target , though many would argue that New Cooperative is exactly that because it provides feed to livestock.

In a post on its darkweb site, BlackMatter threatened to publish 1 terabyte of data it claimed to have stolen from New Cooperative if its ransom demand was not paid by Saturday.

The person close to New Cooperative with knowledge of the case, speaking on condition they not be further identified, would not say whether a ransom was paid.

Based in Fort Dodge, Iowa, New Cooperative stores and markets the grain it collects and offers , fertilizer, crop protection and seed, according to its LinkedIn .

© 2021 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed without permission.

Citation: Iowa farm cooperative hit by ransomware, systems go offline (2021, September 21) retrieved 2 December 2023 from
This document is subject to copyright. Apart from any fair dealing for the purpose of private study or research, no part may be reproduced without the written permission. The content is provided for information purposes only.

Explore further

Accenture claims 'no impact' in apparent ransomware attack


Feedback to editors