Cold Storage, Hot Targets: Hackers Hit French Fridges and Dutch Deliveries

October 23, 2026

Takeaways

• Criminal threat actors and perpetrators of nation-state espionage continue to target critical infrastructure organizations, including the Food and Agriculture Sector.
• Organizations should evaluate their cybersecurity posture to ensure it continues to meet modern-day standards and expectations and address risks.

• Organizations that lag behind in modernization and preparedness will likely face repeated challenges not only to their own security from threat actors and regulatory scrutiny, but also in conforming security as a vendor or supplier in the broader ecosystem.

• Organizations should maintain and exercise both a technical and legal response plan. The legal response plan will help address potential notification, liability, regulatory, and other legal issues related to cyber incidents.

***

Recent cybersecurity attacks in the Food and Agriculture Critical Infrastructure Sector, targeting food retailers, highlight expanding cyber threats to this industry. One attack reportedly simultaneously impacted the refrigeration and freezer units at hundreds of French grocery stores and underscores the vulnerabilities of legacy and unpatched systems. The threat actors used remote access built into the systems to raise temperatures, causing widespread food spoilage. The sophistication of this attack has led to speculation that Russian threat actors may be responsible, in response to France’s support of Ukraine.

Another attack on a Dutch company with food retail brands across the United States and Europe forced the company to take its systems offline “as a precautionary measure.” This attack provides a window into the types of disruption that organizations can plan for, mitigate, or prevent with advance cybersecurity incident response preparation and resilience planning.

Security Updates and Retirement Remain Critical

In the grocery store incident, the systems attacked by the threat actors were at their end of life (EoL), meaning they no longer received security updates. The vulnerabilities of these systems were commonly known. Continued use of EoL systems, especially those that are internet-connected with identified vulnerabilities, endangers operations – particularly as AI is increasingly leveraged by threat actors to chain together and exploit. If an organization plans to replace an EoL system, it should ensure the new system is quantum resistant or cryptographically agile. Any internet-connected systems that can receive updates should be updated promptly to minimize the risk of exploitation by a malicious cyber actor and should be secured with a VPN or other means.

Preparedness, Planning, and Practice

In the second attack, the Dutch company made a “business decision” to take its brands’ websites, apps, and food deliveries offline. Although the exact circumstances surrounding the incident have not been publicly disclosed, it highlights broader considerations regarding preparedness and resilience.

Avoiding or minimizing disruption of critical infrastructure operations is increasingly a focus of the Cybersecurity and Infrastructure Security Agency (CISA) in parallel with the Trump Administration’s National Resilience Strategy. According to CISA’s recent guidance, “[r]esilience means doing the work up front to prepare for a disruption, anticipating that it will in fact happen, and exercising not just for response but with a deliberate focus on continuity and recovery, improving the ability to operate in a degraded state, and significantly reducing downtime when an incident occurs.”

Consistent with CISA’s resilience messaging, we have found, across numerous incidents and government investigations, that advance preparation can help smooth incident response, limit damage, reduce costs, and reassure regulators and customers that a program was reasonably designed in response to evolving risk.

What Does Genuine Cyber Preparedness Look Like?

A written incident response plan is important, but it is not enough. Genuine preparation requires clear roles, trained personnel, backup decision-makers, coordinated plans, and repeated testing.

• Companies should identify a primary leader and supporting personnel for each critical workstream so that one person does not become a single point of failure. They should also maintain a centralized record of legal, statutory, or contractual notification triggers, deadlines, emerging facts, and decisions made throughout the incident.
• Cyber incident response planning is much like crisis management and preparedness. Legal, IT, communications, compliance, and business continuity plans should operate as a coordinated whole and be developed with input from the other teams involved in a response.
• Outside counsel or consultants should be identified in advance and, if feasible, put on retainer to speed incident response. This can be especially important if an organization is targeted as part of a cyber campaign or coordinated attack affecting multiple victims that are seeking to retain the leading cybersecurity experts for assistance.
• Regular tabletop exercises should reflect the organization’s sector, operations, information, and risk profile, and should test more than the technical response. A properly scoped exercise may evaluate:

- Resource management and crisis response
- Communications management
- Limits of acceptable downtime
- Business disruption
- Lessons learned

Regulatory and Other Legal Risk

As the legal and regulatory landscape continues to change, it is important for organizations not only to secure their operational technology and IT systems but also to prepare for cyber incident notification obligations – and for greater cyber regulations. As we have discussed in recent articles, new cyber incident reporting rules are being finalized pursuant to the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) that will require critical infrastructure entities, including the food and agriculture industry, to report cyber incidents within 72 hours and ransom payments within 24 hours. Contractual requirements that increasingly include security standards, and enforcement by federal and state regulators, bring additional scrutiny to the cybersecurity practices of companies suffering an attack. Third-party notification when personal, medical, financial, or other sensitive information is compromised can frequently result in class action litigation or regulatory enforcement actions.

In sum, as the cyber threat environment expands, companies need to update vulnerable systems to withstand attacks and prepare for responding to incidents.