Building cyber resilience together: at Levoplant, cyber security is a top priority

Cyber security – it’s something we simply cannot ignore. Cyber incidents are on the rise in the floriculture sector. It's no longer a question of whether you'll be hit, but when. This is why it's vital for growers and buyers – and the sector as a whole – to strengthen their resilience against cyber incidents. In the series "Building cyber resilience together", growers and buyers explain how they approach cyber security. In this edition: Levoplant, an orchid grower based in Honselersdijk. 

Ron Fransen is not really an IT expert, he says. As director and co-owner of Levoplant, however, he is certainly interested. And he recognises that digitalisation will only grow in importance. This leads him to invest in machinery and technological solutions that simplify daily tasks. But he also invests in digital systems. “To give an example, we’re among the frontrunners at Floriday,” says Ron, who understands that a grower these days also needs skilled IT staff.  

IT Architect & Coordinator Emile Aleman has been with them for eight years. “Every IT professional working in the floriculture sector wants to be ahead of the pack and drive digitalisation as far as possible. But you do need a management board that supports this. That’s how it is at Levoplant,” says Emile. “We’ve already come a long way, but our new location will soon be using cutting-edge technology throughout. All the systems there communicate with each another and exchange data. This provides innumerable opportunities, but also poses risks.” 

The importance of network segmentation  

Levoplant is committed to cybersecurity. Two-factor authentication (2FA), a strict password policy and compulsory cybersecurity e-learning for staff have been standard practice for years. A special app protection policy applies to company data on mobile devices: a device must meet strict security requirements, for example, if an employee wishes to access their work email on their phone. Accounting software automatically checks invoices and bank account numbers to prevent incorrect payments. 

Levoplant has also implemented network segmentation. Emile explains: “By segregating systems, we reduce their vulnerability. If something goes wrong in one area, other networks are not immediately compromised. We make clear agreements with suppliers: what type of connection is required and how will it be secured? Not all manufacturers are equally knowledgeable in this field. For example, we once had a discussion with a supplier who doesn't use 2FA. It's not something they consider important, whereas for us the damage could be enormous if systems or processes are disrupted. If we can’t control the cooling, we’ve got a massive problem." 

From 2027, companies that automate glasshouse horticulture will face additional responsibilities under European legislation and regulations. At Levoplant, this is viewed as a joint endeavour. “We want to support suppliers in that process. That's why we're working with our IT partner Yielder to explore how we can contribute ideas and provide practical solutions, ensuring that suppliers are ready for the future with scope for innovation.” 

Raise the alarm 

Whereas Ron used to think, “What could cybercriminals possibly gain from us?”, he now realises that his company is indeed an attractive target. Phishing emails have been sent in his name – even in Polish to Polish contacts. WhatsApp messages featuring his name and photo, probably taken from LinkedIn, have also been circulating. “Cybercriminals are becoming increasingly cunning, and AI is helping them in this. That’s exactly why human intuition is becoming more important: is this an email or message I should be receiving, or should I raise the alarm?” says Emile.  

Levoplant raised the alarm in April this year, when a phishing attack affected part of the floriculture sector. The grower from Honselersdijk was the first to report the incident to the Cyber Resilience Centre Greenport, an initiative that Royal FloraHolland helped launch. “We heard that one of our customers had been affected,” Emile says. “This was followed by Ter Laak Orchios. Our sales department also received those phishing emails. Our colleagues had their doubts, so they didn’t click on anything. Our colleague Frank van Holsteijn raised the alarm with Plantform and the Cyber Resilience Centre. This is one reason a coordination team was quickly established within Royal FloraHolland to take action. We also informed other companies in our sector. One factor in keeping damage to a minimum was the swift and effective action of Ter Laak Orchios.” 

Working together on resilience 

According to Emile, the incident highlights the importance of collaboration within the sector. “We need to tackle this together, because we’re all in the same boat. By acting promptly, you’ll be helping fellow businesses, yourself and the whole sector. One reason is that, as an industry, we are still relatively inexperienced in this area. Criminals are well aware of this and consequently regard the floriculture sector as an attractive target. So it's good that we're able to connect with each another through channels such as the Cyber Resilience Centre and share experiences and advice. This is how we make the sector more resilient.” 

Ron adds, “It’s great that Royal FloraHolland is taking the lead on this, both in helping to launch the Cyber Resilience Centre and through its free Cyber Subscription. Levoplant is a large company with the resources to invest in people and equipment. This is harder for small-scale growers. They need a helping hand to get started. A next step is for cybersecurity to become part of certification schemes such as MPS. Because digital security and cyber resilience are crucial for the entire sector."  

Would you like to find out more about cyber resilience after reading this interview and/or sign up for the free RFH Cyber Subscription? Then visit www.cwgreenport.nl/royalfloraholland.