Supermarket cyber attacks: Known risks, repeated failures

We spoke to cyber security expert Dr Asma Adnane about what these incidents reveal when attackers target operational technology, the physical systems that keep businesses and services running, including raising important questions about risk management, accountability and resilience.

“Following any cyber attack, the most important question is ‘was this vulnerability already on someone's risk register?’

“In the recent attack on French supermarkets' refrigeration systems, public reporting suggests vulnerabilities affecting the controllers had been disclosed months before the incident. The supplier released a firmware update before the attack, so the risk was known but not acted upon at scale.

"The incidents now affecting systems across several European countries appear to be using the same method, suggesting that even after the original attack made headlines, many operators still failed to act."

More than a cyber security problem

“What makes these incidents particularly interesting is that they highlight a broader issue than technology alone. This was not just a cyber security problem. It was a governance problem.

“That is becoming an increasingly common challenge as organisations rely on third parties to manage and maintain business-critical operational systems. When ownership of security responsibilities becomes blurred, vulnerabilities can persist for years without being addressed.”

An overlooked weakness

“Although attribution remains unclear, the vulnerability became widely known after the French attack received extensive media coverage. Other groups, potentially unrelated to the original attackers, may then have sought to exploit the same weakness elsewhere.

“This shows how quickly a known, unpatched vulnerability can be copied - the same thing happened with the recent PHP incident.

“Often, operational systems can sit outside of many organisations’ mainstream cyber security efforts. Many cyber security reports* show that operational technology is poorly visible and becoming increasingly targeted, and that critical infrastructure resilience is a growing concern for organisations and governments.”

Resilience must become a priority

“No organisation can guarantee it will never experience a cyber incident. The real measure of resilience is how well it prepares for one.

“This means understanding what operational assets exist, identifying dependencies, continuously assessing vulnerabilities, and prioritising remediation according to business impact, whilst also ensuring that critical services can continue to operate safely during a disruption.

“The lesson from these incidents is simple: organisations need to treat operational technology as a business risk, not just a technical one. Food supply is part of critical national infrastructure. If an attack can stop food from being stored or sold, cyber security is no longer just an IT issue."

ENDS

For further comments or interview requests with Dr Asma Adnane, please contact the PR Team or call 01509 222224.