Cyberattacks on European grocery refrigeration systems highlight risk to Canadian food supply

A new series of suspected cyberattacks has caused refrigeration failures in supermarkets across at least nine European countries, resulting in significant food waste. One Swedish store reported its systems were remotely set to 50 degrees Celsius. This follows an earlier wave that affected grocers in France, Belgium and the Netherlands, with tonnes of perishable items having to be discarded. The incidents demonstrate a security weakness that experts warn could impact Canada's food industry.

The perishable nature of fresh food makes refrigeration systems a prime target, according to Sylvain Charlebois, director of the Agri-Food Analytics Lab at Dalhousie University. Grocers operate on tight schedules where even a few hours of disruption can lead to spoiled inventory and lost sales. "Perishability gives attackers a deadline they can use against any food company," Charlebois wrote. Determining precise temperature fluctuations after an attack is often impossible, forcing stores to throw out products even after systems are restored.

This vulnerability extends to Canadian operations, where a cyberattack could necessitate costly inventory replacement, shipment rerouting and emergency repairs. Over time, such disruptions and increased cybersecurity spending may contribute to rising food prices. The final impact at the checkout depends on market competition and which companies can pass the extra costs to others. Ransom is a likely motive, as attackers know the financial pressure on a company mounts with each hour perishables spoil.

READ MORE: Alberta MPs press Liberals on food costs as government touts grocery benefit

READ MORE: Grocery price 'blackout' does not freeze consumer bills, analysis shows

Charlebois notes that while public anger over grocery prices is widespread, it does not clarify who conducted these attacks or their specific goals. The events could also represent intentional sabotage without a financial demand. For years, cybersecurity received scant attention at food industry gatherings, but Charlebois argues it now warrants the same priority as food safety. Beyond refrigeration, a breach at a processing plant could compromise ingredient controls, allergen labelling or contamination traceability records.

Increased automation improves efficiency but also raises the stakes for controlling access to production systems and ensuring staff can respond quickly to malfunctions. Large grocery chains and food manufacturers are upgrading their facilities and systems for greater resilience. A more complex issue arises when these large players impose strict cybersecurity standards on their suppliers. A small, family-owned processor with one plant cannot easily absorb the costs of audits, monitoring and training that a national retailer spreads across hundreds of locations.

Charlebois warns that losing a major retail contract over an unaffordable cybersecurity requirement could threaten an otherwise sound small business. Canada's dominant grocers have the power to establish security standards throughout much of the supply chain. They could also assist suppliers in meeting those standards through shared training, common requirements and technical support. This approach would help smaller processors secure their operations without managing a unique compliance program for every large customer. Protecting the broader supply chain is in a grocer's own interest, as a shipment can be lost if a supplier's plant is compromised.

With files from Toronto Sun