Cyber Risk Is a Food Safety Risk: Lessons from the Refrigeration Attacks

In the food industry, malicious tampering has traditionally meant deliberately introducing a harmful substance into the supply chain, such as an allergen like peanuts, either to injure consumers or to extort the company. Attacks on refrigeration systems are a newer variation on the same threat: rather than adding something to the food, they compromise the conditions that keep it safe.

“In these recent instances, the threat actors did not attack the companies themselves; they gained access through networked devices commonly used across a number of businesses,” said Kerridge. “The timing was also considered: the French attack took place on a Sunday evening and made use of the defrost cycle, when a rise in temperature would ordinarily be expected.”

Whether the intention was nuisance and chaos, or a demonstration of capability ahead of a future ransom demand, these were overt attacks. States are usually stealthier, so if Iran was behind the French attack, being noticed was the point: a message, at a time of heightened geopolitical tension, about how reliant Western states are on operational technology (OT) across critical national infrastructure. OT are the systems that run physical processes such as refrigeration and are distinct from the IT systems that run a business.

Not every attack would be so obvious. In a canning facility, for example, where the product must reach a critical temperature for a set time, it is not clear that anyone would be alerted if a cook cycle were lowered by five degrees or shortened slightly. The damage would not be felt immediately but some weeks or months later, potentially as a food poisoning outbreak.

How exactly these recent systems were exploited is not yet known and may never be. The attackers triggered defrost cycles through remotely managed controllers, likely by exploiting known system vulnerabilities.

Before the attacks, the US Cybersecurity and Infrastructure Security Agency had alerted on vulnerabilities in the supervisory system controllers designed for food retail refrigeration: an authentication bypass in May 2025 and a command injection flaw in August 2025. Whether these were the specific vulnerabilities exploited remains unclear, but they introduce an important issue. Vulnerabilities exist, and fixes are often available, yet exposure persists.

The vulnerabilities identified in 2025 were addressed through firmware updates, but these were likely not implemented: an update takes time, and the refrigerators would have had to be switched off while the updates were installed. This may have been deemed an unacceptable disruption to business operations that outweighed the risk of exploitation, meaning the risk was simply tolerated. Alternatively, there may have been no individual or organization properly overseeing the risk management process at all.

Both explanations lead to the same questions the business should be able to answer: Who oversees this risk? How are system vulnerabilities identified and escalated? What exposures exist, and how will they be addressed? 

“Configuration and change management are critical here,” said Thomas Brambell, Consultant, Information Security, Crisis24. “Threat intelligence should identify vulnerabilities and escalate them, and a proper change management process should then oversee and implement the fixes as part of wider risk management.”

Although refrigeration is the vulnerability currently in the news, the same considerations apply to any networked OT system. A refrigerator that is simply switched on and off, and is not networked or connected to the internet, is unlikely to present an issue; it is remote monitoring that introduces the exposure. Food businesses now use remote access for energy management, pest control monitoring, fire systems, remote diagnostics of manufacturing line equipment, and the monitoring of temperatures in transit. Each of these connections is a potential path for an attacker.

The food safety implications are not confined to temperature. Where ingredients and packaging are ordered automatically and operators work from the recipe on a screen, tampering with those systems could easily introduce an allergen into a product or remove it from the label, causing a serious food safety incident and likely a brand damaging product recall.

Production-line engineers didn’t always think of themselves as part of food safety, yet a careless repair could leave metal shards in food, and a snack bar forgotten in a toolbox could introduce an allergen. The industry came to see engineering work as a potential food safety risk, and that thinking is now accepted and forms part of standard planning. Cybersecurity is now heading the same way, toward being a routine part of food safety and food defense planning.

Cybersecurity, by contrast, is often framed as an IT matter, in terms of disaster recovery: for example, restoring systems and getting purchasing and email back up and running. The refrigeration incidents were not IT incidents but OT incidents, affecting the controllers and programmable logic controllers (PLCs) that run the equipment. That distinction matters because it determines who owns the risk and what the remediation looks like. The actual impact on food safety is a different question. Some businesses, offered a cyberattack as a simulation exercise, have responded that it does not affect them and will never happen.

"The risk needs to be considered holistically within a business, as part of overall risk management,” said Brambell. "This means taking account of all aspects of networked equipment across factory operations, manufacturing, and distribution.”

Effectively managing this risk takes two kinds of expertise: an understanding of what a breach could mean for food safety, and the cybersecurity knowledge to identify vulnerable paths into networked systems. Crisis24 brings both, with food safety and cybersecurity consultants working side by side. Its cybersecurity security services include risk assessment, penetration testing, business continuity planning, and round-the-clock incident response, alongside simulation exercises. Our product risk services include product recall planning, training, and simulation exercises, along with food safety strategy, training, and supply chain risk management. To discuss a tailored risk management strategy that covers food safety and cybersecurity, contact us at [email protected].