A cyberattack on food supplies across Europe is a wake-up call on the risks of connected devices in the food industry. The attackers reportedly did not steal a single record or encrypt any files; they just turned up the heat—literally. They increased the temperature on refrigerators in hundreds of supermarkets. The lesson goes beyond spoiled fish: security reviews must cover every connected device that keeps your business running, not just the systems that hold data.

What Happened

Hackers remotely triggered defrost cycles at hundreds of European supermarkets and removed the limits that normally cap temperatures. Display cases reportedly hit 122°F for about six hours, which caused refrigerators to fire and stuck companies with food losses into the millions of Euros. But there are still critical, unknown details; there is no apparent motive, no ransom demand, and no one has claimed responsibility.

This was not a sophisticated attack. The reported entry point was ordinary: systems that were end of life or running outdated/unpatched firmware, many of which were sitting accessible on the public internet.

Why It Matters

This is a board-level lesson dressed up as a grocery story: if a connected device can stop your operations, it belongs in your risk program, your vendor contracts and your incident response plan.

• Foreseeability. Some of the affected systems had known vulnerabilities with available patches. In events like this, nobody will ask what the attackers did. They will ask who knew what, and when.
• Vendor Risk. Retailers typically outsource refrigeration to maintenance firms with remote access. Boards will ask who had contractual obligations for security. If your contracts are silent on patching and incident notice, you have your answer.
• Insurance. Physical damage caused by a cyber event sits in the seam between property and cyber policies, and each can point at the other.

What to Do Now

Look beyond data. Start here:

• Inventory Devices. Identify every connected device, who controls it, and whether it needs to be online.
• Secure Equipment. Patch systems on a regular basis, retire end-of-life equipment (or document why you kept it), and determine which devices need internet accessibility.
• Paper Obligations. Require vendors to patch devices, meet security standards, and report incidents—and make them answer for failures.
• Drill and Revise. Run a tabletop and update your incident response plan to account for cybersecurity beyond personal data.

The Bigger Picture

France’s economy minister called the attack a “wake-up call for everyone,” and the EU’s agriculture commissioner warned that “the weaponization of food has become a reality.” No one has attributed this attack, but France’s president recently cited Russian hybrid threats, and Interpol’s CISO says AI is increasing the scale and speed of attacks. Companies need to protect continuity, not just data. The same weaknesses sit in utilities, logistics and food warehouses. The fridge is just the most relatable canary in the coal mine, or the cold room.

By Associate Josh Hansen

Read more stories in Issue 85 of the Food and Beverage Litigation and Regulatory Update >>