Ransomware: incransom claims V&P Nurseries (US) — Agriculture and Food Production

On July 18, 2026, a ransomware attack claimed by the group incransom targeted V&P Nurseries, a U.S.-based agricultural and food production company. This incident was published on the ransomware.live leak site, highlighting a growing threat to the agriculture and food supply chain. While the event itself is not a regulatory change, it serves as a critical real-world example under the EU Cyber Resilience Act (CRA), which mandates cybersecurity requirements for products with digital elements. The CRA framework now increasingly applies to connected devices and software used in critical sectors like agriculture, meaning such attacks demonstrate the operational and compliance risks that the regulation aims to mitigate.

Organizations in the agriculture, food production, and broader agri-tech sectors are directly affected, especially those using IoT devices, farm management software, or supply chain platforms. Compliance teams in these sectors must treat this as a warning that their digital products and services fall under CRA obligations, including vulnerability reporting, security updates, and incident response planning. The attack underscores that even non-EU entities may face CRA implications if they sell connected products into the EU market.

Compliance teams should immediately review their product portfolios for digital elements that could be subject to CRA requirements, particularly those used in critical infrastructure. They should conduct a gap analysis against CRA’s security-by-design principles, ensure incident reporting procedures are in place, and engage with supply chain partners to verify their cybersecurity posture. Proactive threat intelligence monitoring and tabletop exercises simulating ransomware scenarios are also recommended to prepare for potential regulatory scrutiny.