The ransomware group ShadowByt3$ says it has breached Cropwise, the farm management platform run by Swiss agribusiness Syngenta Group. It is demanding $1 million to keep the data it says it took from being published. This is a claim, not a confirmed breach. The only public record is a listing on the group's leak site, written up by the threat intelligence outlet Siberpol. Syngenta has not commented. No regulator filing, breach notification or vendor advisory has been published, and no established security outlet has independently checked the claim. The group says it took about 10.4 MB of data, including user identities, credentials, API keys and agricultural geospatial data. Syngenta says Cropwise covers more than 70 million hectares of farmland in more than 30 countries.
What Happened
Siberpol reports that ShadowByt3$ announced the Cropwise breach on its leak site on 2 June 2026. Siberpol's write-up is dated 10 November 2026, more than five months later. Nothing public explains the gap. The listing may have gone unnoticed, the deadline may have been extended, or talks may have taken place in private. None of this has been reported, and readers should not assume any of it.
The group says it gained unauthorised access to the Cropwise environment. It is threatening to publish the data and contact affected parties if Syngenta does not pay. Siberpol says little is known about who runs ShadowByt3$ or where the group came from.
Some context on the target: Cropwise is Syngenta's digital agriculture platform. In November 2025, Syngenta opened it to outside developers as the "Cropwise Open Platform", so that third parties could build tools on top of its agronomic models and data. In October 2026, Syngenta US launched Cropwise Explorer. This tool lets agricultural retailers monitor several growers' fields at once using satellite imagery, past performance data and AI-generated summaries. Both launches widened the platform's attack surface: more API connections, more third-party integrations and more accounts that can see many farms' data.
What Was Taken
According to the group's claims as reported by Siberpol, the stolen data totals about 10.4 MB. The file count was not given. The group says it includes:
- User identities, corporate email addresses and phone numbers
- Password hashes (described as "encrypted") and session tokens
- API keys
- Geospatial boundary files (field outlines)
- Satellite imagery
- Operational records and machinery tracking logs
Two things stand out. First, the size does not fit the description. Satellite imagery and machinery telemetry usually take up gigabytes, not megabytes. If 10.4 MB is the real total, the haul is probably a small sample or a database extract, not bulk exfiltration of operational data. It could also be a proof-of-access bundle rather than everything the group holds. Second, the most dangerous items are credentials, not personal data. Session tokens and API keys can give access without a password or multi-factor authentication (MFA) if they are still valid. Because Cropwise is now open to third-party developers, exposed API keys could reach beyond Syngenta into partner integrations.
The group's record points the same way. Siberpol also reports that in August 2026, ShadowByt3$ listed UK firm A-Plus Software Limited. It claimed it got in through SQL injection and took 2.65 MB across five files, made up of user account information and password hashes. That claim is also unconfirmed by the victim. Small data volumes and a focus on credentials look like the group's usual pattern.
Why It Matters
Agricultural data is operational data. Field boundaries, satellite imagery and machinery tracking logs show where farms are, what they grow, how much they yield and where their equipment is. That information is commercially sensitive. In aggregate, it also matters for food supply.
Platforms that serve many customers turn one credential into many victims. Recent incidents show this clearly. Sophos X-Ops documented a case in October 2026 where an attacker used ConnectWise Cloud Backup's own application credential to request Microsoft Graph tokens from every customer tenant that had granted it consent. The attacker needed no password and no MFA, and ran the sweep from a single server for about 96 minutes. Huntress, analysing the same activity, saw scripted enumeration mixed with hands-on operator work. Microsoft has attributed the activity to Storm-0940 using an AI agent framework. Huntress says its own data is consistent with that attribution but cannot confirm it independently. There is no evidence linking the ConnectWise activity to ShadowByt3$ or to Cropwise. It matters here because it shows what stolen API keys and session tokens from a widely used platform make possible.
Leak-site claims need checking, not repeating. Small groups often exaggerate. Some lists of stolen data are written to maximise pressure rather than to describe what was actually taken. Data from real "pay or leak" extortion does eventually surface. Harvard's 2025 breach, linked to ShinyHunters, ended up in breach-notification services such as Have I Been Pwned. So far there is no public sign that Cropwise data has been published or verified.
The Attack Technique
How the group got in is not known. ShadowByt3$ has not said how it entered Cropwise, and Syngenta has said nothing at all. The group's only reported claim about its methods comes from the A-Plus Software listing, where it said it used SQL injection. Whether it used the same method against Cropwise is unknown.
The list of stolen data gives some hints. If the claim is accurate, a mix of identity records, password hashes, session tokens and API keys usually points to a compromised application database or backend, not a ransomware attack that encrypts systems. No encryption or service disruption has been reported. That suggests a data-theft extortion attempt rather than a classic ransomware deployment.
For defenders of internet-facing collaboration and application servers more broadly: Kaspersky's Securelist recently described how Storm-2603 exploited the ToolShell SharePoint vulnerabilities (CVE-2025-53770 and CVE-2025-53771). The attackers ran entirely in memory inside the IIS worker process, tried to disable endpoint detection, and then tried to deploy ransomware. This is a separate actor and a separate incident. It is a reminder that initial access through web applications often leaves very little on disk.
What Organizations Should Do
- Cropwise users and integrators should rotate credentials now. Reset passwords, revoke active sessions, and regenerate any Cropwise API keys used by in-house or third-party tools. Do not wait for Syngenta to confirm the breach.
- Monitor API and service-account activity, not just user logins. As the ConnectWise case showed, attacks using an application's own identity skip MFA completely. Alert on token requests from unfamiliar IP ranges, especially VPS providers, and on bursts of machine-speed enumeration.
- Audit third-party app consents and API scopes. List every platform that holds a key or token into your environment. Cut each one down to the minimum permissions it needs, and remove any you no longer use.
- Treat geospatial and telemetry data as sensitive. Classify field boundaries, imagery and machinery logs alongside personal data, with matching access controls and monitoring for unusual exports.
- Harden web-facing applications against injection and in-memory attacks. Test for SQL injection, patch on-premises SharePoint and similar servers, and look for unusual child processes or loaded .NET assemblies in web worker processes.
- Watch for follow-on phishing. The group claims to hold corporate email addresses and phone numbers, and says it will contact affected parties. Warn staff and customers about extortion messages or fake "Syngenta security" messages.
Sources: Cropwise (Syngenta Group) targeted by ShadowByt3$ ransomware group | How to detect fileless attacks exploiting ToolShell: analyzing the... | AI, Scripts, Operator: Inside the ConnectWise Attack Huntress | ConnectWise Cloud Backup application abused in cross-tenant token s... | A-Plus Software Limited data allegedly leaked by ShadowByt3 | Syngenta opens Cropwise digital platform to developers to co-innova... | Syngenta launches Cropwise Explorer to help retailers deliver data-... | Pwned Websites Tyler M-Wise