Latest / Tech Talks With Kinsoft / Hazeldenes – Cyberattack Halts an Aussie Poultry Giant

Transcript

Hazeldenes – Cyberattack Halts an Aussie Poultry Giant · Tech Talks With Kinsoft

0:00
Welcome to Tech Talks with Kinsoft. Imagine walking
0:03
into your local butcher on a Friday afternoon,
0:05
you know, expecting to pick up dinner and finding
0:08
the display cases completely empty. Just bare
0:11
shelves. Right, bare shelves. And not because
0:13
of a drought or a transport strike, but because
0:16
someone hundreds of miles away clicked a bad
0:20
link in an email. Or maybe an unpatched VPN appliance
0:23
finally got exploited. Exactly. You're standing
0:25
there looking at empty shelves, realizing that...
0:28
The physical world, the food we eat, the supplies
0:31
we buy is entirely at the mercy of the, well,
0:34
the invisible chaotic world of computer code.
0:37
It is a jarring realization for most people,
0:39
honestly, because we tend to view our supply
0:41
chains as these robust physical entities, you
0:44
know, made of trucks and warehouses. Yeah, tangible
0:47
things. Right. But the reality is that every
0:49
single physical item you rely on is tethered
0:51
to a digital backbone. And when that digital
0:53
backbone fractures, the physical world doesn't
0:56
just slow down. It violently stops in its tracks.
0:58
Which brings us to the focus of our analysis
1:00
today. We're looking at a major cybersecurity
1:03
incident that hit the physical world incredibly
1:06
fast and undeniably hard. The February 2026 cyber
1:10
attack on Hazeldeans. That's the one. One of
1:13
Australia's largest poultry producers. Our mission
1:15
today is to, well, pull this incident apart.
1:19
We want to look at the mechanics of the attack,
1:22
the staggering supply chain shockwave it triggered,
1:25
and why a company would purposefully initiate
1:27
a catastrophic IT shutdown as a line of defense.
1:31
Because for you listening, understanding the
1:33
architecture of this attack really means understanding
1:36
your own vulnerabilities. Exactly. And to really
1:38
understand those vulnerabilities, we have to
1:40
look past the surface level disruption. I mean,
1:42
this is a story about the convergence of information
1:45
technology, your standard data networks and operational
1:48
technology. The actual physical machinery on
1:50
the factory floor, right? Right, exactly. When
1:52
you bridge those two worlds without bulletproof
1:56
segmentation, a digital breach instantly becomes
1:59
a physical crisis. We're talking a complete halt
2:01
of operations. Well, let's ground this in the
2:03
scale of the target because Hazeldeans is not
2:06
some, you know, boutique mom and pop farming
2:09
operation. They are a massive logistical empire
2:12
based in Victoria. Massive is almost an understatement.
2:16
Right. We're talking about processing roughly
2:18
900 ,000 birds every single week. Wow. Yeah,
2:22
that translates to producing over 85 million
2:25
kilograms of chicken annually. I mean, they supply
2:28
major supermarket chains, wholesalers, independent
2:32
butchers all across the region. And this operation
2:35
spans over 50 different highly integrated sites,
2:38
doesn't it? It does. Farms, hatcheries, processing
2:41
plants, all anchored by their massive Lockwood
2:43
South facility. See, the scale is precisely what
2:46
makes them a target. When you have an operation
2:49
of that magnitude, where farms must feed into
2:51
hatcheries on a strict schedule, and hatcheries
2:54
feed into processing plants, and then processing
2:56
plants feed into cold chain distribution. It's
2:58
all connected. Completely. You are running a
3:00
finely tuned, highly pressurized engine. Okay,
3:03
let's unpack this, because I have to play devil's
3:05
advocate here for a second. Sure, go ahead. If
3:07
I'm a sophisticated threat actor, why go after
3:10
a poultry processor? I mean, we typically hear
3:12
about hackers going after banks, tech giants
3:15
or health care data where there's an obvious
3:17
treasure trove of intellectual property or easily
3:21
monetizable data. What's the leverage here? Well,
3:25
what's fascinating here is how modern ransomware
3:27
syndicates operate now. They've realized that
3:30
data theft. While lucrative is complicated. Because
3:32
you have to find a buyer. Right. You need a buyer
3:35
or you have to hope the victim pays to keep it
3:37
quiet. But if you target a company processing
3:40
900 ,000 live animals a week, you aren't just
3:43
stealing data to sell. You are weaponizing their
3:46
own biological ticking clock against them. It's
3:49
all about targeting uptime. Halting processing
3:51
and packaging creates immense urgency, which
3:54
hackers try to leverage. Because the product
3:56
is perishable. Perishable and living. I mean,
3:59
think about the mechanics. A bank can often weather
4:01
a few days of system outages. Transactions get
4:04
queued. Ledgers update asynchronously later.
4:06
It's a headache, but the money doesn't rot. Exactly.
4:09
In agriculture, you have living animals that
4:12
require automated feeding, climate control, welfare
4:15
management. And once processed, you have meat
4:18
that requires strict refrigeration and immediate
4:20
packaging. So if you halt those conveyor belts,
4:23
you create an immediate visceral crisis. And
4:26
the hackers leverage that immense operational
4:28
pressure, knowing the company is bleeding millions
4:30
of dollars by the hour to try and force a rapid
4:33
ransom payment. Which sets the stage for Thursday,
4:36
the 19th of February, 2026. This biological ticking
4:40
clock was suddenly weaponized against Hazeldeans.
4:44
Right. They detected a cyber attack actively
4:46
moving through their environment. Yeah. Employees
4:48
started experiencing login issues, which is the
4:51
classic hallmark of a compromised Active Directory.
4:54
Absolutely. That or the domain controller issue.
4:56
And then the company had to start frantically
4:58
shutting down Wi -Fi networks at one or more
5:00
of its sites to contain the spread. Now, I want
5:03
to look closely at this immediate defensive response,
5:05
shutting down the whole IT system. The kill switch.
5:08
Right, the kill switch. Shutting down the whole
5:11
IT system feels like turning off the main water
5:14
valve to your house because of a leaky sink.
5:17
You know, you can't shower or drink, but you
5:19
save the foundation. That's a good way to put
5:21
it. But in an integrated facility processing
5:24
almost a million birds a week, isn't the cure
5:27
of a total shutdown almost as catastrophic as
5:30
the digital disease? It feels that way. Yeah,
5:33
it is extreme. But if we connect this to the
5:36
bigger picture. Looking at the mechanics of a
5:39
modern intrusion, it's often the only viable
5:41
option. Really? The only option? In manufacturing,
5:45
yes. Let's say a threat actor gains entry through
5:47
a compromised credential on an unpatched external
5:50
VPN. They don't just sit on that one server.
5:52
Right. They spread. They use automated scripts
5:55
to move laterally. They scan the environment.
5:57
map out the network architecture, attempt to
5:59
escalate privileges, and they actively hunt for
6:02
the corporate backups to encrypt them before
6:04
dropping the ransomware payload. They want to
6:07
ensure that when they lock you out, you have
6:08
absolutely no way to restore your systems. Precisely.
6:11
Now imagine Hazeldeans with its 50 interconnected
6:14
sites. You have corporate offices, logistics
6:17
hubs, and the automated processing lines at Lockwood
6:20
South. And historically, those were separate.
6:22
Right. Historically, corporate IT... In factory
6:25
floor operational technology, the OT were kept
6:28
completely separate. They were air gapped. Right.
6:30
Literally no physical connection. But in the
6:32
pursuit of efficiency, you know, predictive maintenance,
6:35
data analytics, companies have converged these
6:37
networks. Now, the email server can often talk
6:40
to the server controlling the conveyor belts.
6:42
Oh, wow. So if Hazeldeans doesn't intentionally
6:45
bulldoze those digital hallways the moment they
6:47
detect lateral movement, the infection... Crosses
6:50
the bridge. Exactly. It crosses from the digital
6:52
IT space right into the physical OT space. A
6:56
rapid IT shutdown halts production, sure, but
6:59
it prevents the total compromise of the entire
7:01
network. So the sudden Wi -Fi shutdowns, the
7:04
login blocks, the total IT freeze, it's all about
7:07
creating artificial air gaps on the fly. That's
7:09
the brutal calculus of incident response. If
7:13
they allowed that malware to encrypt the programmable
7:16
logic controllers on the factory floor. They
7:19
wouldn't just be offline for a few days. They
7:21
could be forced to physically rip and replace
7:23
hardware. Which would keep them offline for months.
7:26
Exactly. So they had to pull the plug. And Hazeldeans
7:28
did follow standard responsible incident response
7:32
protocols during this chaos. Right. They engaged
7:34
external cybersecurity experts immediately. They
7:37
notified the relevant Australian authorities.
7:40
And they made it very clear that their absolute
7:42
priority was the welfare of their staff, the
7:45
animals, and their customers. Which is critical
7:48
in these situations. Definitely. Interestingly,
7:50
at the time of these initial reports, they hadn't
7:52
confirmed if any employee or customer data was
7:55
actually compromised. But they did promise to
7:59
notify affected individuals, if so. And that
8:01
points to the sheer complexity of the forensics
8:04
involved. In the immediate aftermath of pulling
8:07
the plug, the cybersecurity teams aren't focused
8:09
on reading logs to see what data left the building.
8:12
They just want to stop the bleeding. Right. They're
8:15
focused on containment. and eradication. They
8:18
have to assume the threat actors have left back
8:20
doors, persistent footholds hidden throughout
8:22
the environment. Which really explains the timeline
8:25
of the recovery. Because they detected the attack
8:28
on Thursday, February 19th, but they only began
8:32
a phased return to production safely and securely
8:35
around February 25th. Which is a long time in
8:37
that industry. It is. For anyone keeping track,
8:40
that's essentially a full week of massive disruption.
8:43
Why does it take almost a week to reboot systems
8:46
if you've supposedly isolated the threat? Because
8:49
a phased return is a painstaking, highly technical
8:52
process. You cannot simply wipe a server, restore
8:55
a backup, and plug it back into the wall. Because
8:58
the backup might be infected too. Exactly. If
9:00
the threat actor compromised your active directory,
9:03
the system that manages all user permissions,
9:05
your backups might contain those same compromised
9:07
administrative accounts. If you restore them,
9:10
the hackers just log right back in. Wow. So you
9:13
are essentially rebuilding the digital foundation
9:15
of the company while the physical company is
9:17
paralyzed. You are. The external experts have
9:20
to deploy specialized monitoring agents across
9:23
every endpoint. They have to verify the integrity
9:26
of the backups in an isolated environment. It
9:29
sounds exhausting. It's incredibly tense. They
9:31
have to rebuild network segmentation rules from
9:34
scratch to ensure that when the processing plant
9:36
at Lockwood South comes back online, it is completely
9:39
walled off from the corporate network. A slow
9:42
phased reboot is critical to ensure the threat
9:45
is completely eradicated. Only when a system
9:47
is certified completely clean can it be slowly
9:50
integrated back into the production environment.
9:53
Here's where it gets really interesting, though.
9:55
Because while the IT teams and forensics experts
9:57
are playing this incredibly tense game of digital
10:00
cat and mouse deep inside the servers. The physical
10:03
world outside the plant is dealing with the immediate
10:06
consequences of that bulldozed network. The supply
10:09
chain shockwave. Exactly. The moment Hazeldeans
10:12
hit that digital kill switch, it sent a shockwave
10:15
straight into the Victorian economy. I mean,
10:17
we are talking about immediate, highly visible
10:19
chicken shortages hitting wholesalers, butchers
10:22
and supermarkets almost overnight. This is the
10:25
harsh reality of the just -in -time supply chain
10:27
model. Over the last two decades, logistics have
10:31
been heavily optimized for capital efficiency.
10:33
Because warehousing product is expensive. Exactly.
10:36
So the modern supply chain has been engineered
10:39
to have virtually no buffer. The product moves
10:42
continuously from farm to processor to retailer
10:45
to consumer. But wait, I have to challenge that
10:48
assumption, though. We are talking about a company
10:50
producing 85 million kilograms of chicken a year.
10:54
True. Surely a massive integrated operation of
10:57
that scale has some kind of strategic cold storage
11:00
reserve, like a week's worth of frozen product
11:03
they can fall back on when the conveyor belts
11:05
stop. Well, it's a logical assumption, but it
11:07
ignores the economic margins of the wholesale
11:09
meat industry. While they certainly have cold
11:11
storage, it's designed for staging and immediate
11:13
distribution. not long -term strategic buffering.
11:17
Oh, okay. Freezing massive quantities of fresh
11:19
poultry degrades the quality, alters the price
11:22
point, and requires immense energy overhead.
11:25
The industry relies on fresh daily deliveries
11:27
to maintain cash flow and product standards.
11:30
So when you sever the IT systems that coordinate
11:32
the logistics of those daily deliveries, the
11:35
downstream economy starves instantly. Instantly.
11:38
The digital shutdown empties the physical shelves.
11:41
The sources provide some incredible ground -level
11:44
anecdotes that really paint a picture of how
11:47
quickly the starvation happens. Take Georgia
11:50
Polidorus Gilmore. Right, from Oroso Poultry.
11:53
Yeah, she's the manager of Oroso Poultry, which
11:55
is a significant meat wholesaler. She told reporters
11:58
that they knew by Thursday, the exact same day
12:01
the attack was detected and the IT systems went
12:04
dark, that they were not going to get their crucial
12:06
Friday delivery. And we aren't talking about
12:08
a casual afternoon drop -off here. No, these
12:10
birds... are scheduled to arrive at 2 .0 a .m.
12:13
That 2 .0 a .m. delivery window is the absolute
12:16
lifeblood of a wholesale operation. That specific
12:19
delivery dictates everything they can process,
12:22
portion and send out to their own retail clients
12:24
later that same morning. So when the trucks fail
12:27
to show up at 2 a .m., the entire downstream
12:29
network of restaurants, cafes and supermarkets
12:32
misses their morning stock. It's a domino effect.
12:35
And the chaos wasn't just caused by the lack
12:37
of product. It was compounded by a complete breakdown
12:40
in communication. I mean, listen to the story
12:43
of Nathan Grayling. The butcher, right? Yeah,
12:45
he's a regional butcher who relies on a major
12:48
weekly delivery to stock his shop. And notably,
12:51
that includes supplying all the chicken for the
12:53
local pubs in his area. He arrived at work on
12:56
the weekend, ready to prep for the massive weekend
12:58
rush, and found that his entire order had completely
13:01
failed to arrive. With zero notification. Exactly.
13:04
Exactly. The most staggering part is he had absolutely
13:07
zero notification. No phone call, no email, no
13:11
warning whatsoever. Businesses were just left
13:14
scrambling. See, this raises an important question
13:16
about the broader resilience of the food supply
13:18
chain. And the silence Nathan experienced actually
13:21
makes perfect sense when you think about it.
13:23
Because their systems were down. Right. When
13:25
Hazeldeans bulldozed their network to contain
13:27
the ransomware, they didn't just shut down the
13:30
factory machinery. They likely had to sever their
13:32
exchange servers, their automated logistics portals,
13:35
their customer relationship management databases.
13:37
Oh, wow. So they couldn't have warned him even
13:40
if they wanted to. The staff literally may not
13:43
have had the digital means or even access to
13:46
the contact lists to systematically notify their
13:48
clients that trucks weren't coming. So you have
13:51
Nathan standing in an empty butcher shop, ringing
13:53
around to other local supermarkets and competing
13:56
butchers only to find out they didn't get any
13:58
chicken either. Just total blindness. Right.
14:01
He's left scrambling, trying to figure out how
14:03
to run a small business and supply these local
14:06
pubs with absolutely no product and no situational
14:08
awareness. Which brings us to the global context
14:11
here. Because the incident at Hazeldean's in
14:14
Victoria is not an anomaly. It's part of an alarming
14:17
trend of food industry cyber attacks worldwide.
14:21
Threat actors have realized that targeting these
14:23
specific industries guarantees maximum disruption.
14:26
Exactly. Maximum disruption equals immense public
14:30
pressure, which means a higher likelihood of
14:33
an extortion payout. The sources explicitly map
14:36
out this global pattern. And it's startling when
14:38
you look at it all together. I mean, we've seen
14:40
the massive Japanese beverage group Asahi hit
14:43
with an attack. Right. A huge player. Over in
14:45
the United States, the giant grocery wholesaler
14:48
UNFI faced severe operational disruptions. In
14:52
Europe, the dairy producer Arla Foods had a major
14:55
German site impacted. It's happening everywhere.
14:58
Down in South Africa, another major poultry producer,
15:00
Astral Foods, actually had to issue a formal
15:03
profit warning to investors because a cybersecurity
15:06
breach hit their operational capacity and bottom
15:09
line so hard. Don't forget Canada. Right. In
15:12
Canada, the major meat processor, Maple Leaf
15:15
Foods, suffered a sophisticated system outage
15:18
and publicly stated they had to reject a ransom
15:20
demand. When you analyze that list of victims,
15:23
a clear theme emerges. These are legacy manufacturing
15:26
and processing companies that have undergone
15:28
rapid digital transformation over the last five
15:30
to 10 years. They've taken physical machinery
15:32
that was designed to run in isolation for decades.
15:35
And they connected it to enterprise IT networks.
15:38
They bolted Internet connectivity onto industrial
15:40
control. systems to harvest data without necessarily
15:43
architecting the security boundaries required
15:46
to protect those systems from modern extortion
15:48
syndicates it's the ultimate double -edged sword
15:51
isn't it the very connectivity that allows a
15:53
company to track efficiency down to the microsecond
15:56
is the exact same pathway a hacker uses to shut
15:59
down the entire plant exactly every connection
16:02
between a corporate laptop and a factory floor
16:04
sensor is a potential attack vector When you
16:07
compromise that connection, you are no longer
16:10
just dealing with a data privacy breach. You're
16:12
dealing with the physical world. Right. You are
16:14
dealing with the immediate loss of physical production
16:17
capacity. You lose the fundamental ability to
16:20
process raw materials and put food on shelves.
16:23
So what does this all mean? Let's pull all these
16:26
threads together. If we look at the entire life
16:28
cycle of the Hazeldeans incident, we see a chilling
16:31
chain reaction. A domino effect from start to
16:33
finish. Yeah, a digital vulnerability at one
16:36
single company. You know, perhaps an unpatched
16:38
gateway or a compromised credential allowed threat
16:41
actors into the network. Right. That intrusion
16:43
forced the company into a massive defensive I
16:46
.T. shutdown to prevent lateral movement. That
16:49
digital shutdown immediately halted the physical
16:52
processing and packaging of millions of kilograms
16:55
of perishable food. And that physical halt instantly
16:59
choked the local supply chain. Leaving wholesalers
17:02
paralyzed, butchers empty handed and communities
17:05
without product. It proves, I think beyond a
17:08
shadow of a doubt, that modern cyber threats
17:10
are no longer abstract, invisible data problems.
17:12
They are tangible, physical threats to our daily
17:15
lives. It forces a complete reevaluation of how
17:17
we categorize risk. For decades, securing a physical
17:21
supply chain meant building higher fences, installing
17:24
better locks, hiring security guards. But today,
17:27
the most dangerous threat to the physical delivery
17:29
of goods is entirely digital. If your network
17:31
architecture is flat, your supply chain is fragile.
17:34
It's that simple. It really makes you stop and
17:36
think about the hidden dependencies in your own
17:38
operations. For you listening right now, consider
17:41
the businesses you interact with daily or the
17:43
infrastructure of your own company. digital shutdown.
17:49
Could you survive the week? Right. If you detected
17:52
lateral movement on your network tomorrow and
17:54
had to proactively bulldoze your own digital
17:56
hallways to stop a spreading threat, how would
17:59
your business function? How would you communicate
18:01
with your clients? And I'll leave you with this
18:04
final thought to mull over. We have spent the
18:06
last half century optimizing our entire world
18:09
for speed and capital efficiency, systematically
18:12
stripping away the safety buffers to deliver
18:14
goods just in time. Yeah. Zero buffer. But if
18:17
sophisticated threat actors are increasingly
18:19
realizing that targeting our food and physical
18:21
supply chains causes immediate real -world panic
18:25
and maximum distortion leverage, are we entering
18:28
an era where our grocery lists, our local businesses,
18:31
and our dinner tables are ultimately dictated
18:33
by the strength of corporate firewalls? Wow.
18:36
It is a profound, unsettling reality that we
18:39
all have to navigate. To ensure your own operations
18:41
are secure against these types of cascading physical
18:44
and digital disruptions, visit www .kinsoft .com
18:47
.au to discuss your security and IT needs today.