Cyberattacks on the Supply Chain: What Are the Implications for Food Security?

During the night of 11 to 12 October, a cyberattack affected hundreds of large-scale supermarkets across France, destroying thousands of food items. Beyond the immediate disruption to the supply chain that it caused, this incident raises questions about the vulnerability of the food system to digital threats and, more broadly, the potential impact of hybrid threats on food security. What are the consequences of a cyberattack on such a scale? What are the risks to food security? How can businesses and the agricultural sector protect themselves from these hybrid threats? We discuss this with Sébastien Abis, director of the DEMETER Club and associate researcher at IRIS.

What impact has this cyberattack had on the supply chain in France, and what challenges does it raise? Why target the cold chain?

During the night of 11 to 12 October, a cyberattack struck the refrigeration systems of several hundred French supermarkets. According to the latest provisional figures, nearly 700 shops belonging to various chains are believed to have been targeted. Hackers remotely took control of certain refrigeration units, notably those manufactured by the Danish firm Danfoss, causing abnormal defrost cycles and very sharp rises in temperature. Other equipment, supplied by Copeland and Dixell, was also affected.

The consequences are economic, health-related and logistical. Losses already run into millions of euros, or even tens of millions according to some initial estimates. Staff at the affected shops have had to remove and destroy, as a precautionary measure, foodstuffs whose safety could no longer be guaranteed. Logistics centres have been mobilised to organise emergency supplies, particularly of frozen goods, and to manage the flow of fresh produce. Maintenance work, technical inspections and insurance assessments are also required. At this stage, this does not constitute a general disruption to the French food supply chain, but rather a significant disruption to one of its essential components. Let us not lose sight of the fact that we have a demanding and complex food system, in which logistical efficiency and food safety traceability achieve remarkable levels of performance. Consumers do not always realise the full extent of what goes on behind the scenes before they make their purchases in-store.

Why focus on cold storage? Because it is, in fact, one of the key components of our food safety, essential for ensuring that products are safe, wholesome and nutritious. We often think of agricultural production and consumer trends when we talk about food. Yet there are all the intermediate stages – from processing to transport – where temperature control is vital for the quality and food safety of produce. Meat, fish, dairy products, frozen foods and many ready meals depend directly on this unbroken cold chain. And time is of the essence for operators: a prolonged interruption can be enough to render goods unfit for sale.

It is important to understand that this technological modernisation is primarily part of a drive towards enhanced food safety. To improve their performance, optimise costs and better control their facilities, companies have increasingly adopted connected equipment and remote control systems. However, whilst these innovations help to protect consumers and bring considerable benefits, they inevitably create new potential vulnerabilities. When digital access points are inadequately secured or software is no longer up to date, the risks increase. This is all the more true in a context where destabilising threats are on the rise. Initial investigations into this large-scale cyberattack have highlighted, in particular, the use of outdated software – some of which is directly accessible via the internet – but have not ruled out any possible origins for these attacks.

The other lesson concerns our technological interdependencies. Several competing retail chains may share the same suppliers of software, industrial automation systems or maintenance solutions. A common vulnerability can therefore have simultaneous consequences across hundreds of shops that are otherwise commercially independent. A risk that is initially localised can become collective, or even systemic, due to technological concentration and the interconnection of business activities.

This issue extends beyond France’s borders. Several IT incidents have also been reported in the European retail sector, notably in the Netherlands and Belgium. The Ahold Delhaize Group has therefore temporarily shut down certain IT systems as a precautionary measure. It should nevertheless be emphasised that no technical link has been established at this stage between this incident and the attacks on French cold storage facilities. The fact that these events occurred simultaneously is not sufficient to prove the existence of a coordinated operation. It does, however, raise questions.

At the international level, the recurrence of cyber-attacks is part of a broader trend of rising hybrid threats. To what extent could these threats become a means of destabilising food security, particularly in the context of contemporary conflicts?

Those who wish to harm European countries or France know that targeting the food supply is tantamount to striking at the very heart of daily life in our societies. This situation ultimately compels us to broaden our understanding of food security within the digital and geopolitical context in which we find ourselves. Food can be perfectly produced, processed and delivered, only to be destroyed within a matter of hours because the digital system responsible for preserving it has suffered a functional breakdown or has been deliberately compromised. This, too, is what hybrid warfare entails: striking at people’s morale and creating disorder to weaken a nation’s social cohesion, striking at the lifeblood of the economy and, therefore, prioritising those sectors that are indispensable. This includes the food sector, and consequently the upstream agricultural, fisheries and aquaculture sectors. All means are therefore fair game: disinformation, sabotage or even cyber-attacks, all driven by the same desire to harm and destabilise the adversary.

History teaches us that control over food supplies has always been a strategic tool. Sieges, blockades, the destruction of crops or trade restrictions can leave populations and economies vulnerable. Today, digital tools – ranging from disinformation to cyber-attacks – can add to this arsenal of destabilisation. Several recent cases have illustrated this. In 2021, the global meat giant JBS suffered a cyberattack that disrupted its industrial operations in the United States and Australia. That same year, in Sweden, around 800 Coop shops had to close temporarily following an attack on an IT service provider that affected their till systems. In 2024, the retailer Ahold Delhaize experienced IT disruptions in the United States. In 2025, Marks & Spencer and Co-op in the United Kingdom were also hit by cyberattacks with significant commercial and logistical consequences. However, a distinction must be made between the nature of an attack and its strategic consequences. A cyberattack may be the work of organised crime, with no specific geopolitical intent, whilst still revealing vulnerabilities that could be exploited in the future by state actors or as part of a hybrid conflict. A cyberattack on the food supply chain is therefore not automatically an act of hybrid warfare. But it may give others ideas. And so it can certainly be just that – there’s no point in denying it.

With regard to the events of the past few days in France, the identity of the perpetrators and their motives have not yet been established. No public claim of responsibility has been identified at this stage, and a criminal investigation is under way. It would therefore be premature to attribute these attacks to a foreign power or to a coordinated political operation. However, the scale of the disruption and its concentration over a short period of time warrant our full attention. This is all the more so given that other companies and logistics platforms handling fresh produce are also reported to have been hit by cyber-attacks. We must be concerned about this convergence of events, the possibility of them recurring and, above all, what might happen on a wider scale in the future. We must now consider other scenarios. Violent groups could seek to sabotage agricultural fields or food processing plants, or aim to breach animal biosecurity on livestock farms, possibly with the support of foreign actors. Drones could target storage facilities and agricultural silos to carry out acts of eco-terrorism and contaminate crops. These are forward-looking hypotheses, not established facts in the current case, but they deserve to be included in our strategic thinking. IT paralysis and temperature manipulation are not the only ways to create food insecurity and destabilise societies.

Each disruption can be overcome in isolation, but when they accumulate, they can trigger a cascade of effects that are difficult to control. It is precisely this combination of risks and threats – what I call ‘adversities’ – that must now be the focus of our attention. We must therefore consider the issue of disinformation for what it truly is. In our societies, food remains an extremely sensitive issue. Rumours of shortages, fake news about product contamination or campaigns designed to undermine confidence in food safety amplify the effects of fear and division.

How can businesses and the agricultural sector anticipate and protect themselves against hybrid threats?

Each organisation structures itself according to its activities, resources and critical dependencies. It would be difficult to propose a single model that could be replicated by every business. However, in France – and more specifically within businesses – we must change the way we think about risk. Risk exists; it takes many forms and interacts with other issues. To put it another way, we in Europe must stop believing in zero risk, without, however, becoming paranoid. For a long time, agricultural and agri-food businesses have mainly sought to protect themselves against climatic hazards, price fluctuations, health crises or supply disruptions. These issues obviously remain on the agenda. But other challenges are emerging and will require us to strengthen our risk management policies – or at the very least, to prioritise them. This is the role of strategic foresight within organisations, alongside what I call the gradual shift towards a ‘risk intelligence’ approach. And ‘intelligence’ necessarily means not underestimating human dynamics. Many cyber incidents begin with an error, negligence or inappropriate behaviour, sometimes following a phishing attempt. However, organisations also remain vulnerable to human intelligence, manipulation, espionage and acts of internal malice. Just because cyberattacks are on the rise does not mean we should lose sight of human vulnerabilities. Training, collective vigilance and a culture of security remain essential.

Strengthening security at sensitive sites is essential. But who should be responsible for this, and who should fund these enhanced security measures? Given the current economic climate, the more delicate question we must ask ourselves is that of our ability to operate in a transformed strategic environment – one that is more challenging and, at times, threatening. And therefore, to learn to function in a deteriorating situation. This is probably the challenge: ensuring operational continuity in the face of adversity and minimising the damage when blows come thick and fast or attacks multiply. This issue is particularly important in agriculture and the food sector, as biological and health-related constraints never cease. Seeds must be delivered, animals must be fed and watered, fresh produce preserved, crops harvested and processing chains maintained under appropriate sanitary conditions. Certain industrial operations can be postponed, but the needs of living beings cannot be put on hold indefinitely. This applies to plants, animals and human beings alike. This ‘farm-to-fork’ or ‘sea-to-table’ logistics system has been working very well for decades. It is a feat we should recognise more often. Let us not wait for potentially violent disruptions to do so.

At European level, the NIS2 Directive reflects this growing awareness by strengthening cybersecurity requirements across numerous sectors, including certain food production, processing and distribution activities. However, regulation will never replace operational preparedness on the part of businesses, which must take this broader range of risks into account and continue to produce, process and supply food despite disruptions, thanks to the work of farmers and fishermen and strategic support from public authorities. The resilience of our food supply and consumer safety depend on it.

---

This article has been translated from French into English using artificial intelligence.