They Survived 150 Years… Until Ransomware

What Canada’s oldest chocolate manufacturers cyberattack teaches every business about privileged access and identity security.

Ganong Bros. has been making chocolate in Canada for more than 150 years. The family-owned company survived changing consumer tastes, recessions, world wars, supply shortages, and dramatic advancements in technology.

Then, in February 2025, everything changed. Conveyor belts stopped. Orders couldn’t ship. Employees waited for systems to come back online. Customers didn’t know when deliveries would resume.

The company immediately brought in external cybersecurity specialists, legal counsel, and forensic investigators to contain the incident and determine what had been compromised. Operations were temporarily interrupted while systems were secured and restored. Ganong’s attack wasn’t unusual.

According to IBM’s 2025 Threat Intelligence Index, manufacturing has been the world’s most targeted industry for ransomware attacks for four consecutive years.

That should make every Canadian business owner stop and think. Because Ganong isn’t a global technology company. It isn’t a bank. It isn’t a government agency. It’s a successful Canadian business that depends on technology just like thousands of businesses across the country. If it can happen to one of Canada’s oldest and most respected manufacturers, it can happen to almost any organization that relies on digital systems.

Cybercriminals Don’t Care What You Sell

Manufacturing. Construction. Engineering. Healthcare. Retail. Hospitality. Professional services. Your industry isn’t what makes you a target.

Cybercriminals don’t choose victims based on what they sell. They look for organizations they can get into and take control of.

Many businesses assume attackers are primarily after their data. But data is often only part of the objective. The real turning point in an attack comes when cybercriminals gain administrative control of your systems.

Once inside, attackers quietly move through the network, searching for accounts with elevated privileges. If they obtain administrator-level access, they can:

• Encrypt servers and files
• Disable security tools
• Access cloud environments
• Reach financial systems
• Steal sensitive customer and company information
• Impersonate employees
• Lock users out of critical business applications
• Disrupt operations and demand a ransom

At that point, the industry you’re in matters very little. What matters is the level of control the attacker has gained.

In other words, they now control your business. They decide what runs, what stops, who gets locked out, and how much you’ll have to pay to get it all back.

Why Small Businesses Are Increasingly Targeted

Think cybercriminals only target large enterprises? Think again. According to Verizon’s 2025 Data Breach Investigations Report, small and medium-sized businesses are targeted nearly four times more often than large organizations. The reason is simple: attackers look for the easiest path to valuable data and privileged access, not the biggest company.

Small and mid-sized organizations often have:

• Valuable customer information
• Financial resources
• Critical operational systems
• Smaller IT departments
• Limited cybersecurity staff
• Less mature identity governance

From an attacker’s perspective, that’s an attractive combination. Enough value to justify the effort. Not enough security to slow them down.

Ransomware Is the Final Stage

When employees see a ransomware message on their screens, the attack is already well underway and attackers have already achieved their primary objective, complete administrative control of your environment.

Long before files are encrypted, attackers have typically spent days, weeks, or even months inside the network. During that time, they quietly steal credentials, gain administrative privileges, disable security controls, map critical systems, and identify the organization’s most valuable assets.

The encryption is not the beginning of the attack. It is the final act. The real breach happened long before anyone knew they were there.

The Business Impact Goes Far Beyond IT

Ransomware doesn’t just shut down systems. It can bring an entire business to a standstill. Production stops. Payroll can’t run. Finance can’t issue invoices. Customer service loses access to critical systems. Shipping is delayed. Suppliers can’t see orders. Executives lose email. Within hours, the organization shifts from running the business to managing a crisis.

Legal counsel, cyber insurers, forensic investigators, regulators, customers, suppliers, and the media can all become part of the recovery effort. While the financial costs are measurable, the damage to customer trust and reputation often lasts much longer.

One Compromised Account Can Change Everything

Most organizations have a relatively small number of accounts with extraordinary levels of access, including Domain Administrators, Cloud Global Administrators, Service Accounts, Backup Administrators, and other privileged IT accounts. These identities represent your organization’s blast radius.

If just one of these credentials is compromised, an attacker can rapidly move across systems, access sensitive data, disable security controls, and disrupt business operations on a massive scale. The greater the privileges associated with an account, the greater the potential impact. Cybercriminals understand this better than anyone.

If attackers obtained one of your privileged accounts today, how much of your business could they control?

How Exposed is Your Organization?

Take the free Ransomware & Data Breach Gap Assessment to uncover the identity security gaps attackers are most likely to exploit. No registration. Five minutes. Instant results.