The US Department of Agriculture (USDA), the Federal Bureau of Investigation (FBI), and the Food and Drug Administration Office of Criminal Investigations (FDA OCI) are all sounding the alarm about business email compromise (BEC) attacks that result in the theft of shipments of food items and ingredients.
BEC is frequently used to steal money. Threat actors compromise email accounts at target firms, then target employees who handle payments by sending them phony emails instructing them to wire huge sums of money to bank accounts under the attackers' control.
The threat actors, however, are utilizing spoofed emails and websites to mimic real businesses in the attacks aimed at the food and agricultural industry and order food products without paying for them. In the events that were seen, the thieves took cargo worth hundreds of thousands of dollars.
“Criminals may repackage stolen products for individual sale without regard for food safety regulations and sanitation practices, risking contamination or omitting necessary information about ingredients, allergens, or expiration dates. Counterfeit goods of lesser quality can damage a company’s reputation,” the agencies caution in a public statement.
Hackers may employ spear phishing and other ways to compromise email accounts at a real organization and send fake messages, or they may construct email accounts and websites that closely resemble those of actual businesses.
When contacting the target businesses, the attackers may use the identities of real executives or workers, and they may utilize authentic corporate logos in their bogus emails and papers to lend credibility to their claims.
Government agencies claim that threat actors may also fabricate credit applications in an effort to deceive the target company into giving credit. Attackers give valid firm information to the target business, which causes it to ship the ordered goods but never get paid for them.
In one of the most recent attacks, a US sugar supplier was the target. She was asked to supply a truck full of sugar, but she recognized the fake email and got in touch with the real company to confirm it.
A food distributor dispatched two full truckloads of powdered milk in a different attack after receiving an email from a forged account that used the real name of the chief financial officer of a large international snack food and beverage firm. The supplier received a $160,000 payment from the victim company.
Another incident saw the attackers placing fraudulent orders for big supplies of powdered milk and other materials while posing as a US corporation, resulting in losses of over $430,000.
A US food supplier and manufacturer was the target of a BEC attack in April that used a fake email from a legitimate business to send two shipments totaling more than $100,000 for which it never got paid. A food company in February received orders from four distinct scammers totaling roughly $600,000 but never got paid for them.
Food and agriculture businesses are advised to independently verify the contact information of new suppliers or clients, look for signs of spoofing in links and email addresses, check the wording and grammar of all correspondence, confirm changes to invoices and payment details, be wary of orders and payments that seem to be urgently needed, ask for clarification on questions that seem suspicious, and train staff to recognize BEC scams.
