MOST ATTACKS START WEEKS BEFORE THE SCREENS GO DARK. HERE'S HOW TO TELL IF SOMEONE'S ALREADY INSIDE.
It’s a little after 9 on a Thursday night in October. The last truck crossed the scale at the satellite location an hour ago. The office is dark. The GM is home, and the IT manager is asleep, because tomorrow starts at 5:30 again.
On the network, an account set up in August for a seasonal scale operator signs in. Not from the scale house. From a laptop nobody at the co-op owns.
It doesn’t lock anything. It doesn’t leave a ransom note. It looks around. Which servers are there. Where the backups live. Who has admin rights.
Nobody notices, because nothing went wrong. Tomorrow the trucks roll again.
That’s what “already exposed” usually looks like. Not a locked screen. A quiet login during the busiest week of the year.
Because harvest is when a co-op can least afford to be down, and attackers know it. In April 2022, the FBI warned the food and agriculture sector that ransomware groups may be more likely to go after cooperatives during planting and harvest. The notice pointed to six grain cooperatives hit between September 15 and October 6, 2021. Some had to halt production entirely. Others lost their administrative systems.
The FBI’s reasoning was plain. Attackers may see co-ops as “lucrative targets with a willingness to pay,” because the work can’t wait.
That pressure hasn’t eased. The Food and Ag-ISAC counted 227 ransomware incidents against food and agriculture through July 2026, up 62% over the same stretch in 2025. We covered why attacks have gotten so cheap to run in It Costs $4 to Attack Your Business. It Takes Weeks to Recover.
For a general manager, though, the most useful part of that FBI notice isn’t the warning. It’s the list of how attackers got in: known software flaws that hadn’t been patched, infections that spread through shared network resources, and compromised managed services. In other words, doors that were already open.
No. The locked screens are usually the last step. Before the ransom note, an attacker has to get in, find their way around, pick up more access, locate the backups, and often copy data out to threaten you with later. That takes time, and none of it announces itself.
Every one of those steps leaves a trace somewhere. A sign-in that doesn’t fit. A new admin account. A backup job that quietly stops. The question is whether anybody is looking.
That gap between getting in and pulling the trigger is the best chance you’ll get. It’s also why timing matters. Someone who gets in during August doesn’t have to act in August. They can wait for the week when the co-op is under the most pressure to pay.
The candid answer: from the inside, in the middle of harvest, you probably wouldn’t. Exposure doesn’t feel like anything. Systems run. Tickets print. Nobody calls IT.
But exposure does show up in a handful of specific places, and most of them can be checked. These are the six we’d look at first at any co-op.
Every harvest adds people. Seasonal scale operators, extra drivers, temporary office help. Each one usually needs a login, and those logins don’t always get turned off when the season ends.
Shared logins make it worse. When five people use one account at the scale house, nobody notices a sixth.
Pull every active account on your network and in Microsoft 365, then compare it against who is on payroll today. Last year’s seasonal help, former employees, and generic accounts with passwords nobody has changed in years are all doors someone can walk through.
Microsoft 365 records where and when every account signs in. A login from another state at 2 a.m. is worth a look. So are two logins from places hundreds of miles apart within the same hour.
Watch for new inbox rules, too. Attackers who get into an email account often set up rules that forward copies of messages somewhere else or quietly delete replies. It lets them watch conversations about grain contracts and payments without anyone seeing it happen.
Passwords leak through phishing emails and through malware on home computers and contractor laptops. Then they get sold. You can’t see any of that from inside your building.
Dark web monitoring watches breach dumps and criminal marketplaces for your company’s logins, so a password can be reset before someone uses it. Pair it with security awareness training so your people can spot the email that started it.
The FBI named unpatched software as one of the most common ways attackers got into co-ops. Harvest makes this worse. Nobody wants to reboot the scale house PC mid-season, so updates get pushed to “after harvest,” and after harvest turns into spring.
Check the operating system on every machine, too. Windows 10 reached end of support on October 14, 2025. A PC still running it no longer gets regular security fixes unless it’s enrolled in Microsoft’s Extended Security Updates program.
Start with the scale house, the satellite elevators, the agronomy center, and the PC in the corner that “just runs one thing.” Those are the machines that tend to get skipped.
Over the years, most co-ops collect ways for outside people to connect in. An equipment vendor’s support tool. A software company’s remote session. A port someone opened for a contractor who left three years ago.
The FBI’s advice is direct: disable remote access you aren’t using and keep an eye on the logs for what’s left. Make a list of every way someone outside can connect, who it belongs to, whether it still needs to be there, and whether it requires multifactor authentication.
Having backups isn’t the same as having backups an attacker can’t touch. If your backups sit on the same network and use the same admin credentials as everything else, someone who gets in can delete or encrypt them first. Then the ransom note shows up.
The FBI recommends keeping copies of critical data offline or otherwise protected from being changed or deleted from the main system. Ask two questions: if someone had admin access tonight, could they reach our backups? And when did we last restore from one to prove it works?
You don’t have to stop the season to get a real read on this. Most of it is one conversation between the GM and whoever runs IT, about an hour, and a short list of questions:
Add one more that has nothing to do with technology. If the network went down tomorrow, how would you keep grain moving? The FBI recommends identifying critical functions and planning how to run them if systems go offline. For a co-op, that means paper scale tickets ready to go, a phone list that doesn’t live on the server, and clarity on who has the authority to make the call.
If you can’t answer one of these questions, that’s not a failure. That’s the finding.
The difference between exposed and compromised often comes down to whether someone acts on the first sign. That’s the job of managed detection and response, or MDR.
Koltiv delivers MDR through our partnership with Arctic Wolf. It’s included in our ARMOR and FORTRESS managed IT packages, along with dark web monitoring and security awareness training. See what each tier covers on our managed IT packages page.
When a high or critical alert fires, it triggers a live call to a Koltiv technician, at any hour. Medium and low alerts get reviewed during business hours. If a Microsoft 365 account looks compromised, Arctic Wolf’s integration lets us isolate it, cutting it off from email, OneDrive, and SharePoint until it’s cleaned up. We can also set up decoy accounts that no real employee would ever touch. If one of those signs in, it’s not a false alarm.
Go back to that Thursday night. An account set up for seasonal help, signing in from an unfamiliar device after hours, is exactly the kind of signal this is built to flag. The goal is a phone call at 9:15 p.m., not a ransom note at 6 a.m.
One Northwest Iowa co-op runs three feed mills around the clock and counts on that kind of coverage. Their IT director talks about what it’s like in their case study.
Start by finding out where you actually stand. A cybersecurity risk assessment looks at the same places covered here, including accounts, sign-ins, patching, remote access, backups, and who’s watching after hours, and turns it into a prioritized list of what to fix first.
You know your operation and your season better than anyone. We know where attackers look first, because we see this work every day across Iowa co-ops and Midwest manufacturers. Put those together and the list gets short, specific, and doable, even in October.
Next steps
Harvest has a way of making everything else wait. The trouble is, the people looking for a way in are counting on exactly that. An hour with your IT lead this month, with the list above, is a small cost against a week of trucks parked at the elevator. And if the answers come back clean, you get to finish the season knowing it instead of hoping. Give us a call. We’d be glad to walk through it with you.