This morning I went to my usual shop and found a shaken manager. His shop, along with dozens of other Belgian shops, had seen its fridges and freezers go into defrost mode remotely during the night of 1 to 2 November. He was devastated: he had only been alerted very late to what was happening, he had no backup system and, worse still… his insurance did not cover hacking risks. Before my professional side took over, it was above all the human side that was affected. We don’t always talk about large groups, but sometimes about SMEs and managers who do everything they can to keep their business afloat, to make a living from it and to pay their employees. Then my professional logic took over again and I went home to read the news. According to RTL info, the modus operandi is identical to the one observed in France at the beginning of October.
Another Proxy Delhaize manager sums it up: “It can’t get any worse in our line of work.” I believe him. But what I take away from this episode is something other than the “who”.
The “who” should not be our first question
In the hours after an incident, everyone looks for the culprit: hackers, a software flaw, a supplier, a malicious act. That is normal, and the investigation needs it.
But I will say it plainly: for the person who has to throw away their stock, the origin changes very little about the night they have just lived through. A cyberattack, physical sabotage, an insider threat or a simple configuration error can produce exactly the same effect: the cold chain is broken, the stock is lost, the shop slows to a crawl.
In my practice, I therefore always ask the same question before the one about the cause:
- What happens to us if this system stops, whatever the reason?
- Who will know, and how quickly?
- What can my team do on its own at 3 a.m.?
For every shopkeeper, a very hard blow
The impact here is immediate and it falls on independent owners: destroyed goods, lost revenue, a sleepless night, organisation improvised on the spot. They are the ones who pay first.
And what if the attack changes scale?
This is what really worries me. Today it is a few dozen points of sale. Imagine the same logic applied to more central links: warehouses, logistics, processing, distribution. It would no longer be only shop owners who were affected. The effect would spread along the entire food chain, and ultimately to the population.
This is exactly what the logic of critical entities resilience seeks to anticipate: a local disruption can produce cascading effects well beyond the organisation affected. I have seen it in other crises, from floods to COVID-19: dominoes rarely fall where the plans placed them.
What I recommend right now
A plan will not be enough. I see a plan as scaffolding: it allows a trained, trusted team to move forward into the unknown, but it does not replace its ability to decide. In practical terms:
- Map the connected or remotely controlled equipment your business depends on, including what a supplier manages for you.
- Question your suppliers: what protection, what remote access, how quickly can they intervene? The head of a refrigeration company says it himself to RTL: a simple update is not enough.
- Prepare a degraded mode: alerts, a night-time procedure, a fallback solution for sensitive goods.
- Give your teams the right to act. If only the manager can decide, the organisation stops when they sleep. Trust and training are built before the crisis, never during it.
- Look after the people carrying the response: the person who emptied their shop at dawn also needs someone to ask how they are.
What I take from this
Let’s not let the hunt for the culprit overshadow the question of resilience. Cyber, sabotage or insider threat: the result is the same, and so is the preparation. If you want to measure where you stand, let’s talk.