Want to bookmark your favourite articles and stories to read or reference later? Start your Independent Membership today.
Already a member?
Log in
You would have thought there were easier ways to prove your computer hacking prowess than remotely turning off a freezer and defrosting some peas.
And yet, this week, a cyber attack hit hundreds of French supermarkets, sending temperatures in their fridges and freezers soaring. At around 150 Intermarché stores, temperatures reached 50C for six hours overnight. Food was thrown away, fires were reported, and the next morning shoppers found the chilled aisle closed for business. The reported losses from the attack are estimated to run into the millions.
It’s suspected that the hackers targeted the refrigeration software supplied by Danish manufacturer Danfoss. The company said the supermarkets affected were running outdated software that couldn’t ward off the threat they had identified. It said it had “long advised” businesses to update their systems for this very reason.
Remote monitoring sounds convenient for supermarkets… right up until the point when someone figures out how to hack it and you hadn’t thought to invest in the latest smart fridge.
It would be tempting to dismiss this as an unusually French farce. Sacre bleu, how dreadful, pass the brie. Unfortunately, the food we buy in the UK also depends on networks of computers a lot more than most of us probably realise.
The journey from field to fork doesn’t just involve lorries: there are systems to tell farmers when to water crops, factories what to produce, warehouses where to store it and the aforementioned lorries where to take it. Supermarkets use software to keep track of stock, how to price it, and predict what we want for dinner.
Keeping that all running is one massive job. Keeping it secure is another one entirely.
The risks aren’t just straight out of dystopia. In November 2024, a hit on supply chain software company Blue Yonder caused all sorts of problems for Morrisons, which uses its services for forecasting, replenishing and managing stock. A ransomware attack – where criminals essentially “lock” systems and typically demand payment to release them – disrupted the tech the supermarket uses for managing its fresh and chilled food. Staff had to resort to doing it the old-fashioned way, but still there were gaps on the shelves. The supermarket said it also ran into problems with stock accuracy, availability and waste. After all, it’s difficult to sell what you cannot find in the stockroom.
The following year, another expensive reminder of the fallibility of these systems arrived. In April 2025, Marks & Spencer was hit by a cyber attack that took parts of its system offline. Shops stayed open, but again staff were forced to do everything manually. This resulted in a “higher level of markdown and waste caused by manual stock allocation” in its subsequent half-year results. Food had to be reduced or thrown out because M&S couldn’t manage it as efficiently without the technology it had been relying on. For a company that makes much of its ready meals, that must have been difficult to swallow.
Co-op was hit around the same time. Not only did it result in widespread shortages, payment problems and the loss of customer data, but it also disrupted deliveries to its stores. That might not sound like too much of a problem in parts of the UK where there’ll probably be a Tesco Express open until 11pm round the corner, but it’s quite a different proposition on remote Scottish islands where there isn’t an alternative food source. Photographs from Portree on Skye showed alarmingly empty shelves.
Food that could no longer be safely sold was thrown away after hackers reportedly sent refrigeration temperatures soaring to 50C (Reuters)
Sometimes, the problem starts before the food has even been delivered to the supermarket. Americold, a giant refrigerated warehousing business whose customers include Walmart, Nestle and McCain, was forced to take its systems offline in 2023 after a cyber attack left a significant number of its facilities unable to receive or ship out products. This time, the freezers didn’t need hacking. Without functioning logistics systems, the food couldn’t be reliably shipped out. For a supermarket waiting for deliveries, someone else’s cyber vulnerability can very quickly become their own.
Food factories are no more immune. In 2021, an attack disrupted JBS, one of the world’s biggest meat processors, causing problems in North America and Australia. The company paid a ransom of $11m (£7.8m) and said the interruption had only cost it less than a day’s production.
Cyber attacks can target any point within the food system
A government 2024 Food Security Report
On farms, digital systems can control irrigation, monitor growing conditions and handle automated feeding or milking. Not every machine has an open internet connection and many of them have protections or manual overrides, but still: every extra connection needs protecting. A stolen password is bad enough. An irrigation system failing at the height of summer is another matter.
This is not a threat invented by excitable technology analysts. In its 2024 Food Security Report, the British government warned that “Cyber attacks can target any point within the food system”. The National Cyber Security Centre said ransomware was almost certain to be the greatest disruptive cyber threat to the sector. The more that digital systems were connected to the internet, it added, the more attractive and vulnerable food businesses are to attackers.
Banks have it easy. A quick phone call can suspend a transaction without anyone having to physically count the money. Strawberries, on the other hand, cannot be told to stop ripening until the IT department has finished investigating the ticket.
Last year, researchers Richard Jones and Dmitry Feoktistov reviewed 43 studies of cybersecurity across the food supply chain. They found a great many potential weaknesses, but also concluded that “systemic food security risks related to cybersecurity are not adequately addressed by the existing research literature”. Apparently, even establishing how widely certain technologies are used is surprisingly difficult.
Around 150 Intermarché stores were reportedly affected by the attack, raising uncomfortable questions about how secure Britain’s own food supply might be (AFP/Getty)
So how prepared are we for these kinds of attacks? Well, official assessments are probably enough to keep supermarket bosses up at night. In September, the National Audit Office assessed the resilience of Britain’s food supply to serious disruptions, including cyberattacks, and found that “the sector’s ability to withstand catastrophic events that cause severe disruption has not been tested”. The watchdog also said that Defra had not done enough to ensure that resilience.
There are reasons not to panic and start living off-grid – though that does sound rather nice. The UK relies on many different food producers, retailers and suppliers, and businesses have backups in place when things do go wrong. Morrisons kept trading. M&S kept its stores open. JBS lost half a day’s profit. One attack here and there is a long way from shutting down our national supply of food.
But the warning from Sir Ken McCallum, director-general of MI5, on Tuesday was rather timely. Addressing Britain’s wider national security threats, he said: “Our interconnected financial systems, energy grids, supply chains and manufacturing bases, designed during simpler times for maximum efficiency, are vulnerable to malicious disruption and coercion.”
Obviously, he was not claiming that the French fridge hackers were targeting frozen peas on behalf of a hostile state. Nor that they were really singling out the food industry at all. But his broader point is worth a moment of thought. Most of the digital infrastructure we have come to rely on every day was originally built to work efficiently. To make our lives easier. It wasn’t built to withstand someone deliberately trying to break it.
The French freezers show how the damage need not be spectacular to be serious. It can mean food wasted because the fridge has gone off or the software can’t find it in the warehouse. Deliveries can be delayed because the system has forgotten the addresses.
Food security tends to conjure up visions of farms, extreme weather, conflicts blocking waterways many miles away and politicians being hyperbolic in the House of Commons. Increasingly, it also involves screens, keyboards, algorithms and lines of code doing their job out of sight.
Frozen peas don’t generally feature in our conversations about national security. Perhaps they should.