INDUSTRY FACT FILE · FMCG, FOOD & BEVERAGES

Five New Case Studies in FMCG, Food and Beverage Security

Original 2026 case studies, each written as a blog post, showing how current threats play out in consumer goods groups, food processors, beverage companies, dairies and their channels, and how Codec Networks services break the attack chain.

In this document 1.  About these case studies 2.  Case Study 1: The Plant That Ran Out of Labels 3.  Case Study 2: The Scheme That Paid Itself 4.  Case Study 3: The Chiller That Phoned Home 5.  Case Study 4: The Aggregator Payments That Went Elsewhere 6.  Case Study 5: The Loyalty App That Leaked Its Customers

These five case studies were written for this document set and have not been published elsewhere. Each is a composite scenario combining attack techniques and control failures widely observed in FMCG, food and beverages with the obligations that apply in India as of October 2026—in particular CERT-In's Directions and audit guidelines, SEBI disclosure for listed companies, DPDP, FSSAI records and recalls and the retailer and partner requirements that reach consumer goods companies.

Important disclosure The organisations described are fictional and the scenarios are illustrative. They are not accounts of real incidents, and they are not Codec Networks client engagements or claims of achieved outcomes. Their value lies in showing how connected weaknesses form an attack chain, which controls break it, and which services test those controls.

Case study	Organisation type	Core threat	Regulatory lens	Primary bundles
1. The Plant That Ran Out of Labels	Consumer goods group	Ransomware encrypting ERP and order processing	CERT-In; SEBI LODR; retailer contracts	B3, B7, B8
2. The Scheme That Paid Itself	Beverage company	Distributor portal authorisation flaws and insider abuse	CERT-In; Companies Act controls; distributor contracts	B2, B9, B7
3. The Chiller That Phoned Home	Dairy	Cold-chain IoT bridging into plant control	FSSAI; CERT-In; IEC 62443	B11, B3, B1
4. The Aggregator Payments That Went Elsewhere	Food processor	Business email compromise diverting farmer payments	CERT-In; banking; supplier relations	B10, B2, B7
5. The Loyalty App That Leaked Its Customers	FMCG brand with a loyalty programme	Exposed API leaking consumer data	DPDP; CERT-In; consumer trust	B2, B6, B9

Every line could run. For nine days, almost nothing could be ordered, labelled or shipped.

At a glance
Organisation	A listed consumer goods group (“Fmco A”) with eleven plants, forty depots and three thousand distributors on one ERP
Threat	Phishing leading to domain compromise and ransomware across ERP, order management, label printing and depot systems
Why it is new	Consumer goods revenue depends on daily order processing, and order processing depends entirely on IT
Codec Networks services	Segmentation and backups, SOC, forensics (Bundles B3, B7, B8)

The scenario

A phishing email gave attackers a foothold in Fmco A's corporate network. Over three weeks they escalated to domain administrator unnoticed; endpoint alerts were raised but nobody watched them overnight.

On a Friday night, ransomware encrypted ERP, order management, the label-printing servers at every plant, depot systems and the backup server, which sat on the same domain. Lines controlled by segregated PLCs could run, but no order could be taken, no label printed and no invoice raised.

Distributors and modern trade ran out of fast-moving lines within a week. Fmco A ran orders on spreadsheets and hand-written labels at a fraction of volume for nine days, ceded shelf space to rivals and disclosed the incident.

Figure 8: Illustrative attack path for Case Study 1 and the controls that break it.

What went wrong

• Backups were online and domain-joined, so they were encrypted too.
• Order processing depended entirely on IT with no tested manual plan.
• EDR alerts were not monitored 24x7.
• No restart sequence for ERP, order management and label systems.

The impact

Fmco A lost nine days of normal dispatch and a quarter of shelf momentum, paid recovery costs, disclosed the incident under SEBI LODR and faced retailer penalties and insurer questions about backup warranties.

The regulatory lens

• CERT-In Directions: incident reported within six hours; logs needed for investigation.
• SEBI LODR: cyber incident disclosed in the quarterly corporate governance report.
• Retailer contracts: service-level penalties and requests for assurance before restoring integrations.

How Codec Networks would help

Need	Codec Networks response	Bundle
Separate and recover	IT/OT segmentation, immutable backups, tested ERP, order and label system restores	B3
Detect early	24x7 SOC with EDR monitoring and threat hunting	B7
Investigate and report	Forensics, root cause, CERT-In and disclosure support	B8

Key lessons Keep backups immutable and off the domain. Plan and rehearse manual order processing and labelling. Monitor EDR around the clock. Test ERP, order and label restores together.

No ransom, no outage—just trade spend that quietly grew for three quarters.

At a glance
Organisation	A beverage company (“Bevco B”) running trade schemes and claims through a distributor portal and sales app
Threat	Broken object-level authorisation in the portal's APIs, exploited by distributors and a sales insider to inflate claims and secondary sales
Why it is new	Distributor platforms expose scheme logic and claims to thousands of external users
Codec Networks services	Portal and API testing, partner programme, SOC analytics (Bundles B2, B9, B7)

The scenario

Bevco B's distributor portal let any authenticated distributor retrieve and edit claims by changing an identifier in the API call. A regional sales executive discovered this and shared it with a few distributors.

Over three quarters, secondary sales were inflated and scheme claims edited after approval. Approval limits were never enforced in the API, and nobody reconciled claims against depot dispatches.

An internal audit on trade spend variance found the pattern. Investigation showed crores in excess payouts, terminated distributors and a sales executive dismissed.

Figure 9: Illustrative attack path for Case Study 2 and the controls that break it.

What went wrong

• APIs lacked authorisation checks on claim and distributor identifiers.
• Approval limits existed only in the user interface.
• No analytics reconciling claims with dispatches.
• Distributor and insider access was never reviewed.

The impact

Bevco B lost crores in excess trade spend, terminated distributor relationships, strengthened internal controls and reported the incident.

The regulatory lens

• CERT-In Directions: unauthorised data manipulation reported within six hours of discovery.
• Companies Act: internal financial control weaknesses addressed with the audit committee.
• Distributor contracts: terminations and recovery actions under scheme terms.

How Codec Networks would help

Need	Codec Networks response	Bundle
Fix the platform	DMS, app and API testing with authorisation and business-logic checks	B2
Govern the channel	Distributor onboarding, access recertification and contract clauses	B9
See it happening	SOC analytics on claims, secondary sales and post-approval edits	B7

Key lessons Test APIs for authorisation and business-logic flaws. Enforce limits server-side, not in the interface. Reconcile claims with dispatches continuously. Review distributor and insider access regularly.

The temperature dashboard was a success story. It was also the route into the pasteuriser.

At a glance
Organisation	A dairy (“Dairyco C”) with a processing plant, cold rooms and a refrigerated fleet
Threat	Internet-exposed IoT temperature gateways with default credentials used to reach pasteuriser HMIs and alter temperature logs
Why it is new	Cold-chain IoT projects create new bridges between the internet and plant and quality systems
Codec Networks services	IoT assessment, segmentation, OT assessment (Bundles B11, B3, B1)

The scenario

Dairyco C installed IoT gateways in cold rooms and trucks to feed a vendor's temperature dashboard. For convenience the gateways sat on the plant network and were reachable from the internet for the vendor.

The gateways kept default administrator passwords. Automated scanning found them, attackers compromised one and used it to reach the pasteuriser HMIs and the server holding temperature and batch logs, altering several records.

Quality staff noticed inconsistencies during a release review. Unable to trust the records, Dairyco C recalled a batch as a precaution, engaged FSSAI and rebuilt its plant network.

Figure 10: Illustrative attack path for Case Study 3 and the controls that break it.

What went wrong

• No security assessment of the IoT project before go-live.
• Gateways on the plant network with internet exposure.
• Default credentials and unmanaged firmware.
• Temperature and batch logs not tamper-evident, so records could not be trusted.

The impact

Dairyco C recalled a batch, reported the incident, funded an independent assessment and re-architected its cold-chain and plant networks.

The regulatory lens

• FSSAI: batch and temperature records compromised; precautionary recall and regulator engagement.
• CERT-In Directions: incident reported within six hours.
• IEC 62443: IoT devices belong in their own zone behind a DMZ.

How Codec Networks would help

Need	Codec Networks response	Bundle
Assess before go-live	IoT and cold-chain security assessment, device and firmware hardening	B11
Isolate	Segmented IoT zone and DMZ design, no direct internet exposure	B3
Verify the plant	OT assessment with asset discovery, monitoring and tamper-evident records	B1

Key lessons Assess every IoT project before it goes live. Put IoT in its own zone behind a DMZ. Change default credentials and manage firmware. Make temperature and batch records tamper-evident.

The farmers were at the gate before the finance team knew anything was wrong.

At a glance
Organisation	A food processor (“Foodco D”) paying hundreds of farmer aggregators weekly
Threat	Phished procurement manager's mailbox used to submit fraudulent bank-detail changes for large aggregators
Why it is new	Agricultural procurement runs on trust, email and weekly payment cycles
Codec Networks services	BEC simulation and controls, identity and application security, SOC (Bundles B10, B2, B7)

The scenario

Attackers phished Foodco D's procurement manager and monitored the mailbox for weeks, learning which aggregators were paid most and when.

They sent bank-detail change requests from the manager's own mailbox to the accounts team, attaching forged letters. Changes were made without call-back verification, and four weekly payment runs went to mule accounts.

Aggregators who had not been paid stopped deliveries and gathered at the plant gate. Procurement stalled for a week while finance reconstructed payments and banks attempted recalls.

Figure 11: Illustrative attack path for Case Study 4 and the controls that break it.

What went wrong

• No MFA on mailboxes and no alerting on unusual access.
• No call-back verification or dual approval for bank-detail changes.
• Vendor master-data changes were not monitored in ERP.
• Finance and procurement never trained with simulations.

The impact

Foodco D lost most of a month's aggregator payments, suffered supply disruption and reputational damage with farmers, and reported the incident.

The regulatory lens

• CERT-In Directions: mailbox compromise reported within six hours of discovery.
• Banking: recall requests with limited success.
• Supplier relations: compensation and new payment procedures agreed with aggregators.

How Codec Networks would help

Need	Codec Networks response	Bundle
Train and test	BEC simulation for procurement and finance; verification procedures	B10
Harden identity and ERP	MFA, conditional access, vendor master-data change controls	B2
Watch for the signs	SOC alerting on mailbox rules, unusual access and payment changes	B7

Key lessons Enforce MFA and alert on mailbox anomalies. Verify every bank-detail change by call-back. Monitor vendor master-data changes. Run BEC simulations with finance and procurement.

The app won a marketing award. Its API gave away every member's phone number.

At a glance
Organisation	An FMCG brand (“Brandco E”) with an agency-built loyalty app and several million members
Threat	An unauthenticated API endpoint exposing member profiles, phone numbers and reward balances, harvested by scrapers after a disclosure was ignored
Why it is new	Consumer apps are built fast by agencies and hold data that fraudsters use for convincing scams
Codec Networks services	App and API testing, privacy programme, vendor assurance (Bundles B2, B6, B9)

The scenario

Brandco E's agency built a loyalty app in weeks. One API endpoint returned full member profiles without authentication; a security researcher reported it to a generic mailbox and received no response.

Scrapers harvested millions of records. Within weeks, members received scam calls quoting their names and reward balances and offering to 'redeem' them for a fee.

Complaints and media coverage followed. Brandco E took the app offline, notified members, prepared DPDP breach workflows, reported to CERT-In and reviewed every agency-built system it owned.

Figure 12: Illustrative attack path for Case Study 5 and the controls that break it.

What went wrong

• No security testing of the app and APIs before launch.
• No vulnerability disclosure process, so the warning was missed.
• Excessive data collected and exposed for a simple rewards programme.
• No security requirements in the agency contract.

The impact

Brandco E lost member trust, paused the programme, bore notification and remediation costs and faced regulatory scrutiny over consumer data handling.

The regulatory lens

• DPDP: consumer personal data compromised; breach intimation and data minimisation duties.
• CERT-In Directions: incident reported within six hours of discovery.
• Consumer trust: scams targeting members damaged the brand directly.

How Codec Networks would help

Need	Codec Networks response	Bundle
Test the channel	Mobile and API testing before launch and each release	B2
Govern consumer data	DPDP programme: data mapping, minimisation, consent, breach workflow	B6
Assure the agency	Vendor security requirements, reviews and disclosure handling	B9

Key lessons Test every app and API before launch. Run a vulnerability disclosure process. Collect only the data the programme needs. Put security into agency contracts.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com