News

Supermarket cyber-attacks: How can retailers protect themselves?

Cyber-attacks have hit supermarket refrigeration systems across Europe in recent weeks, highlighting the need for a coordinated response to cybercrime, says one expert.

Last month, supermarkets across France were targeted in cyber-attacks that disrupted refrigeration systems throughout around 700 stores. The incident hit major retailers including Carrefour, E.Leclerc, Intermarché, Netto, Monoprix, and Coopérative U and led to product losses and even fires in some instances. The French government is currently investigating the incident.

At a glance:

• Hackers have disrupted refrigeration systems across thousands of stores in Europe, causing compromised food to be discarded.
• Cybercrime threats are becoming more commonplace in the food and beverage industry and are a growing concern.
• Industry must build resilience and timely responses to such attacks, working with all stakeholders in the supply chain.

Then, on 2 November, retailers in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden reported problems with their refrigeration systems. Several supermarkets later confirmed they had been hacked.

So, is cybercrime becoming more of a concern for the food and beverage industry today? According to one supply chain expert, whilst the nature of the French attach was unique, cyber-attacks are certainly becoming more commonplace.

Speaking to Ingredients Network, Emily Field, food sector lead at the UK's National Standards Body the British Standards Institution Group (BSI), said that cyber-attacks have been identified as one of the acute risks facing the UK's food supply chain, for example, alongside extreme weather, energy disruption, and disease outbreaks.

“Food supply chains are becoming increasingly vulnerable to threats, whether that's cyber-attacks or geopolitical and climate instability,” Field said. “The French attack tangibly demonstrated the physical loss and the consequences of these attacks in real time, which is something you don't see often. It shows that resilience and risk preparedness connects many different functions of a business and should be treated as connected issues, rather than managing each one separately.”

Cyberattacks are “a growing concern” for the food industry

Field said that the food and beverage industry faces a number of increasing threats and vulnerabilities, which is “a real and growing concern”.

Particularly given how highly connected, even inter-connected, the sector is, with many different actors in the supply network increasing vulnerability. And all players are at risk, she said, from large retail stores and chains through to suppliers, logistic companies and smaller food and beverage businesses. Pre-empting and protecting against such attacks, therefore, requires consolidated action.

“Companies are operating in an environment where geopolitical, digital, environmental, and economic risks increasingly overlap, yet resilience is still often managed through separate initiatives rather than as an integrated, organisation-wide priority,” Field said.

Instead, companies should be taking an over-arching look to understand what is “genuinely critical to the operation” and take steps to identify expected threats and how best to manage those risks, she explained.

Here, business relationships become key, she said. “Supplier relationships are fundamental to protecting businesses against cybercrime and other vulnerabilities within supply chains. Working with partners that you trust, that you can have quick communication with and share information with can prevent a risk escalating and allow organisations to act quickly and take immediate action when responding to an incident.”

Field said that cyber resilience, for example, is not separate from wider business resilience and requires a “coordinated, joined up approach”.

BSI food defence guidance

According to BSI supply chain research, resilience depends on collaboration across functions and organisations, with risk, continuity, security, procurement and operations working from a “shared understanding of critical dependencies”.

The BSI's PAC 96:2026 Food Defence guidance outlines this and is designed to inform the global food industry on the protection and prevention of deliberate acts – across the entire supply chain, from primary producers and manufacturers through to retailers and SMEs.

Field said the guidance, updated this year following input from government, industry and academia, has guided the global food industry for almost two decades now, with the latest revision reflecting “the realities organisations now face”.

“With the food and drink sector facing growing pressure from geopolitical instability, sophisticated cyber threats and the impacts of climate change, the standard outlines how organisations can identify, assess and mitigate the risks of malicious contamination, ideologically motivated attacks and other intentional disruptions, helping to strengthen safety and resilience across the sector,” Field said.