State-linked operations

Sandworm helped wipe a grain logistics company. Food is infrastructure

A destructive attack on food logistics, not a theft. The same war, a different sector.

Published 21 October 2026

Russian state-linked group Sandworm worked alongside another threat actor to carry out a destructive cyberattack against a Ukrainian grain logistics company last year, researchers said.

This one deserves attention out of proportion to its size, for three reasons.

First, it is destructive, not extractive. Most of what this desk carries is theft — data taken, credentials lifted. This was data wiped. The goal was to break the company's ability to operate, not to profit from it.

Second, the target is food. Grain logistics is how a harvest becomes a supply. We cover the grid, water and telecoms as critical infrastructure, and rightly — but food movement belongs on that list, and it rarely gets put there.

Third, it is the same war, a different sector. Earlier this week we carried VK, disrupted after a drone strike on a data center — a physical attack degrading a national platform. This is the cyber half of the same pressure: energy, media, and now agriculture. When one state is working a country's infrastructure across sectors at once, single-incident stories miss the pattern.

the technique is not country-specific. Destructive operations against logistics and food distribution are a template, and the defensive question is unglamorous — offline backups, segmented networks, and a plan for operating without your systems.

Sources

• The Record, Recorded Future News, 21 Oct 2026, 14:45 GMT Tier 4 — specialist press

Presented by Sunny Burns · SB Sentinel Breach Watch