#Fact Old image of Hindu Priest with Donald trump at White house goes viral as recent.

Introduction

The global food industry is vast and complex, influencing consumer behaviour, policy, and health outcomes worldwide. However, misinformation within this sector is pervasive, with significant consequences for public health and market dynamics. Misinformation can arise from various sources, including misleading marketing campaigns, unsubstantiated health claims, and misrepresentation of food production practices through public endorsement or otherwise. Nutrition misinformation is one such example. The promotion of false or unproven products for profit can lead to mislead consumers and affect their interests. Misleading claims and inaccurate information about the nutritional value of food products and processes are common claims. The misinformation created about food on the global stage distorts public understanding of nutrition, food safety, and environmental impacts, leading to significant consequences for public health, consumer trust, and the economy.

Rise of Nutritional Misinformation and Consumer Distrust

Health and nutrition-related misinformation is one of the most prevalent types in the food sector. Businesses frequently advertise their products as "natural" or "healthy" without providing sufficient data to back up these claims, tricking customers into buying goods that might be heavy in fat, sugar, or salt. Words like "superfood" are frequently used without supporting evidence from science, giving the impression that they are healthier.

Misinformation also impacts the sustainability and ethics of food production. Claims of "sustainable" or "ethical" sourcing are frequently exaggerated or fabricated, leaving consumers unaware of the true environmental and social costs associated with certain products.

This lack of clarity is not only observed in general food trends but also within organisations meant to provide trustworthy information. There has been significant criticism, directed at the International Food Information Council (IFIC), for their alleged promotion of nutrition-based misinformation to safeguard the interests of large food corporations, resulting in potentially compromising public health. The preemptive claims that IFIC made about the nutritive claims have been questioned by the National Institutes of Health, USA in November 2022. They reported in their study that IFIC promotes food and beverage company interests and undermines the accurate dissemination of scientific evidence related to diet and health. This was in support of the objective of the study, which was to determine whether, there have been many claims that the nutritional value of certain foods or diets may be manipulated to favour business goals, leaving consumers misinformed about what constitutes a truly healthy diet.

Another source of misinformation is the growing ‘Free-From’ fad. The “free-from” label in the US is a food category of products that claim to be free from certain ingredients or chemicals. It has been steadily growing by 7% annually. These labels often tout products as healthier due to a simpler ingredient list. Although seemingly harmless, transparency in ingredient disclosure is often obscured in the 'free-from' trend. This can lead to consumer distrust in the long run, making them hesitant.

The Harmful Effects of Food Misinformation

The effects of misinformation about nutrition and food safety can directly affect public health.
Consumers unknowingly may accept false claims or avoid certain foods without scientific basis and adopt harmful dietary habits, potentially leading to malnutrition or other health problems. By the time the realisation sets in about being misled, their trust is eroded not only towards such companies but also towards the regulators. This distrust can lead to declining consumer confidence and disrupt market stability. 

Some food-related misinformation downplays the environmental impact that certain food production practices have. An example of such a situation is the promotion of meat alternatives as being entirely eco-friendly without considering all environmental factors. This can mislead consumers and obscure the complex environmental effects of food production systems. 

Misinformation can distort consumer purchasing habits, potentially leading to a reduced demand for certain products and unfair competition. The sufferers in this case are the small-scale producers who suffer disproportionately, while the large corporations might use this misinformation to maintain their dominance in the market. Regulatory checks, open communication, and public education campaigns are needed to combat mis/disinformation in the global food sector and enable consumers to make decisions that are sustainable, healthful and informed.

CyberPeace Recommendations

• Unfair trade practices like providing misleading information or unchecked claims on food products should be better addressed by the regulators. Companies must provide clear, transparent and accurate information about their products as mandated under the Food Safety and Standards (Advertising and Claims) Regulations, 2018. This information should include the true origins, production methods, and nutritional content on their labels.
• Promotions of initiatives and investments by public health organisations and food authorities towards educating consumers and improving food literacy should encouraged. 
• Regulating social media endorsement is also crucial to prevent the spread of misinformation and unchecked claims. Without proper due diligence on product details, influencers may unknowingly mislead their audience, causing potential harm. 
• The Social Media Platforms can partner with nutritionists, dietitians, and other health professionals who are content creators, as they can help in understanding and promoting accurate, science-based nutrition information and debunk any misleading claims.
• Campaigns should be encouraged to spread public awareness about the harms of food-related misleading claims or trends. Emphasis should be on evidence-based nutritional guidance. The ongoing research towards food safety, nutrition, and true information should be actively communicated to keep the public informed. Combating food misinformation requires more robust regulations, improved transparency, and heightened consumer awareness and vigilance.

References

• https://timesofindia.indiatimes.com/india/label-claims-on-packaged-food-could-be-misleading-icmr/articleshow/110053363.cms 
• https://www.outlookindia.com/hub4business/empowering-change-freedom-food-alliance-takes-on-global-food-industry-misinformation 
• https://insightsnow.com/misinformation-hurting-food-business/ ‍
• https://www.ncbi.nlm.nih.gov/pmc/articles/PMC9618198/pdf/12992_2022_Article_884.pdf

Introduction

In an era where organisations are increasingly interdependent through global supply chains, outsourcing and digital ecosystems, third-party risk has become one of the most vital aspects of enterprise risk management. The SolarWinds hack, the MOVEit vulnerabilities and recent software vendor attacks all serve as a reminder of the necessity to enhance Third-Party Risk Management (TPRM). As cyber risks evolve and become more sophisticated and as regulatory oversight sharpens globally, 2025 is a transformative year for the development of TPRM practices. This blog explores the top trends redefining TPRM in 2025, encompassing real-time risk scoring, AI-driven due diligence, harmonisation of regulations, integration of ESG, and a shift towards continuous monitoring. All of these trends signal a larger movement towards resilience, openness and anticipatory defence in an increasingly dependent world.

Real-Time and Continuous Monitoring becomes the Norm

The old TPRM methods entailed point-in-time testing, which typically was an annual or onboarding process. By 2025, organisations are shifting towards continuous, real-time monitoring of their third-party ecosystems. Now, authentic advanced tools are making it possible for companies to take a real-time pulse of the security of their vendors by monitoring threat indicators, patching practices and digital footprint variations. This change has been further spurred by the growth in cyber supply chain attacks, where the attackers target vendors to gain access to bigger organisations. Real-time monitoring software enables the timely detection of malicious activity, equipping organisations with a faster defence response. It also guarantees dynamic risk rating instead of relying on outdated questionnaire-based scoring.

AI and Automation in Risk Assessment and Due Diligence

Manual TPRM processes aren't sustainable anymore. In 2025, AI and machine learning are reshaping the TPRM lifecycle from onboarding and risk classification to contract review and incident handling. AI technology can now analyse massive amounts of vendor documentation and automatically raise red flags on potential issues. Natural language processing (NLP) is becoming more common for automated contract intelligence, which assists in the detection of risky clauses or liability gaps or data protection obligations. In addition, automation is increasing scalability for large organisations that have hundreds or thousands of third-party relationships, eliminating human errors and compliance fatigue. However, all of this must be implemented with a strong focus on security, transparency, and ethical AI use to ensure that sensitive vendor and organisational data remains protected throughout the process.

Risk Quantification and Business Impact Mapping

Risk scoring in isolation is no longer adequate. One of the major trends for 2025 is the merging of third-party risk with business impact analysis (BIA). Organisations are using tools that associate vendors to particular business processes and assets, allowing better knowledge of how a compromise of a vendor would impact operations, customer information or financial position. This movement has resulted in increased use of risk quantification models, such as FAIR (Factor Analysis of Information Risk), which puts dollar values on risks associated with vendors. By using the language of business value, CISOs and risk officers are more effective at prioritising risks and making resource allocations.

Environmental, Social, and Governance (ESG) enters into TPRM

As ESG keeps growing on the corporate agenda, organisations are taking TPRM one step further than cybersecurity and legal risks and expanding it to incorporate ESG-related factors. In 2025, organisations evaluate if their suppliers have ethical labour practices, sustainable supply chains, DEI (Diversity, Equity, Inclusion) metrics and climate impact disclosures. This growth is not only a reputational concern, but also a third-party non-compliance with ESG can now invoke regulatory or shareholder action. ESG risk scoring software and vendor ESG audits are becoming components of onboarding and performance evaluations.

Shared Assessments and Third-Party Exchanges

With the duplication of effort by having multiple vendors respond to the same security questionnaires, the trend is moving toward shared assessments. Systems such as the SIG Questionnaire (Standardised Information Gathering) and the Global Vendor Exchange allow vendors to upload once and share with many clients. This change not only simplifies the due diligence process but also enhances data accuracy, standardisation and vendor experience. In 2025, organisations are relying more and more on industry-wide vendor assurance platforms to minimise duplication, decrease costs and maximise trust.

Incident Response and Resilience Partnerships

Another trend on the rise is bringing vendors into incident response planning. In 2025, proactive organisations address major vendors as more than suppliers but as resilience partners. This encompasses shared tabletop exercises, communication procedures and breach notification SLAs. With the increasing ransomware attacks and cloud reliance, organisations are now calling for vendor-side recovery plans, RTO and RPO metrics. TPRM is transforming into a comprehensive resilience management function where readiness and not mere compliance takes centre stage.

Conclusion

Third-Party Risk Management in 2025 is no longer about checklists and compliance audits; it's a dynamic, intelligence-driven and continuous process. With regulatory alignment, AI automation, real-time monitoring, ESG integration and resilience partnerships leading the way, organisations are transforming their TPRM programs to address contemporary threat landscapes. As digital ecosystems grow increasingly complex and interdependent, managing third-party risk is now essential. Early adopters who invest in tools, talent and governance will be more likely to create secure and resilient businesses for the AI era.

‍

‍

References

‍

‍- https://finance.ec.europa.eu/publications/digital-operational-resilience-act-dora_en

- https://digital-strategy.ec.europa.eu/en/policies/nis2-directive

- https://www.meity.gov.in/data-protection-framework

- https://securityscorecard.com

- https://sharedassessments.org/sig/

- https://www.fairinstitute.org/fair-model 

‍

‍

Perth, Western Australia — For most of the past year, the name TeamPCP has circulated quietly within cybersecurity circles as shorthand for a particular kind of dread: not the dread of a phishing email or a suspicious link, but the dread of software you already trusted turning against you. This week, that quiet circulation became public record. The Australian Federal Police, working alongside the FBI and the Western Australia Police Force, arrested and charged two Western Australian men, aged 21 and 23, with a combined 14 offences over their alleged role in the group.

The arrests themselves are notable. The story behind them is more so.

A Campaign Built on Borrowed Trust

TeamPCP's alleged method was not to break down the front door. It was to compromise the door itself, the trusted mechanisms by which developers pull code into their own projects every day. The group has been linked to widespread supply-chain attacks that targeted open-source software and developer platforms to steal credentials, authentication secrets, and source code, with high-profile incidents affecting projects including Trivy, LiteLLM, Telnyx, SAP, and TanStack, alongside breaches at organisations such as the European Commission, Mistral AI, OpenAI, and GitHub. Reporting has also linked the campaign to ecosystems including GitHub Actions, Docker Hub, npm, PyPI and OpenVSX, the invisible plumbing through which most modern software is assembled.

The scale, as alleged by investigators, is difficult to overstate. Authorities say the malicious code potentially compromised over a thousand organisations worldwide, enabling the theft of roughly half a million credentials and the exfiltration of at least 300GB of data, figures that should be understood as allegations under active investigation rather than an independently verified victim count. The AFP itself has said the compromise of a small number of trusted software components had a significant global impact, with remediation costs estimated in the hundreds of millions of dollars.

Why This Attack Was So Hard to See Coming

The mechanics matter. Rather than tricking a user into clicking something malicious, the alleged operation worked by compromising the credentials developers use to publish legitimate software updates, then pushing tampered versions out through the same trusted distribution pipelines millions of applications rely on automatically. There is no obviously suspicious file, no rogue website, only a routine update, arriving exactly where it was expected.

Investigators also describe a cascading structure to the intrusions: credentials harvested from one compromised project reportedly opened the door to the next, turning isolated breaches into a chain reaction across the open-source ecosystem. TeamPCP has been described as running one of the most consequential campaigns of software supply-chain attacks investigators have tracked, and the group's reach extended notably into the AI stack — LiteLLM, one of the projects reportedly compromised, is an open-source gateway widely used to connect applications to large language model providers, meaning the attack's blast radius extended into the very infrastructure powering today's AI boom.

The Investigation and the Charges

The two men were charged following a joint investigation by the AFP and WAPF, working in parallel with the FBI, into what authorities describe as a sophisticated cybercrime syndicate accused of creating malicious open-source software to defraud thousands of global businesses. The charges span identity theft, unauthorised data modification, and money laundering, with maximum penalties ranging from three to twenty years' imprisonment. Search warrants were executed in Perth on 26 August 2026, and investigators seized electronic devices for forensic analysis after raids at properties in Cottesloe, Hamilton Hill, and Mandurah. FBI Cyber Division Assistant Director Brett Leatherman noted the significance of the international cooperation involved in the case, while investigators have not ruled out further arrests.

The Real Story: A Governance Problem, Not Just a Crime Story

It would be easy to file this under "hackers caught" and move on. But the more consequential story is structural. Modern organisations do not merely secure their own infrastructure, they inherit risk from every library, package, CI/CD pipeline, repository, vendor and developer tool they depend on, often without ever auditing that dependency chain directly. Guidance from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) on securing open-source software has increasingly emphasised managing these dependencies through software bills of materials (SBOMs), precisely because so few organisations can otherwise answer a basic question: what, exactly, is running inside our systems?

TeamPCP's alleged campaign is a case study in why that question can no longer be optional. If an organisation's security posture is only as strong as the thousands of components it silently trusts, then supply-chain security is not a developer problem to be quietly patched — it is a governance issue, deserving board-level attention, vendor accountability frameworks, and mandatory disclosure practices.

CyberPeace's Take

At CyberPeace, we've been watching campaigns like TeamPCP's less as isolated incidents and more as a pattern that keeps repeating with higher stakes each time. What stands out to our team isn't the sophistication of the code, open-source poisoning is, frankly, not a new technique, it's the sophistication of patience. Compromising a maintainer's publishing credentials and simply waiting for the next scheduled release to carry the payload downstream is a strategy built for an ecosystem that still largely operates on implicit trust rather than continuous verification. That gap between how fast software moves and how slowly trust is actually checked is precisely where operations like this thrive.

We'd also push back gently on treating this as a "developer hygiene" story. Most engineering teams pulling in a package from npm or PyPI are not, and should not be expected to be, forensically auditing every dependency update by hand, that isn't scalable, and it was never a realistic line of defence. The actual fix has to sit further upstream: provenance verification baked into CI/CD pipelines, signed commits and releases treated as non-negotiable rather than optional, and SBOMs that are actually queried during incident response rather than generated once and filed away.

Our broader concern, honestly, is about incentive alignment. Open-source maintainers are frequently unpaid or under-resourced volunteers holding publishing keys to software depended on by billion-dollar enterprises. Until organisations that consume open-source software at scale start meaningfully funding its security, not just its development,  this pattern isn't going away. It will simply find its next entry point.

References

• Australian Federal Police. Two WA men charged following AFP-FBI-WAPF disruption of alleged global cybercrime syndicate. afp.gov.au
• Bleeping Computer. Australia arrests alleged TeamPCP hackers behind supply-chain attacks. bleepingcomputer.com
• CyberScoop. Two alleged TeamPCP members arrested and charged after months of software supply-chain chaos. cyberscoop.com
• Cyber Daily. Busted! Alleged Aussie hackers linked to TeamPCP arrested in joint AFP-FBI-WAPF operation. cyberdaily.au
• Help Net Security. Two alleged TeamPCP hackers arrested over global supply chain attacks. helpnetsecurity.com
• Krebs on Security. Two Alleged 'TeamPCP' Hackers Arrested in Australia. krebsonsecurity.com
• TechCrunch. Australian police arrest two over TeamPCP hacks targeting Mercor, OpenAI, and others. techcrunch.com
• The Hacker News. Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks. thehackernews.com

‍