Forgive me if this issue is thinner than usual (ahem). I’ve been glued to my newsfeeds since waking up Wednesday morning checking the midterm results, instead of reading whatever I can find on the topic I’m writing about and talking to anyone who will speak to me.
That’s why you’ll see more questions and less analysis. But I have a feeling we’ll be returning to this topic - repeatedly, in fact, if I may hazard a guess - so let’s think of this as a teaser.
Beyond the relief of the midterm results, I’m super grateful my little newsletter got a shout out on Semafor’s flagship email briefing for last week’s issue on the UN elections. Thanks for alerting me, Sonalie!
Speaking of, new developments: (1) the candidacy of Lana Nusseibeh for the UN Secretary-General post is no longer a foregone conclusion (also here), and (2) two U.S. agri-lobby groups are pushing for Beth Bechdol, an American and a current deputy director-general at the FAO, to become the agency’s new head.
Given the midterm results, whether we will witness the spectre of two Trump appointees leading two UN food-related agencies remains to be seen.
Lastly, to those heading to Antalya (COP31), good luck and godspeed!
Zombieland. 28 Days Later. The Walking Dead. The Mist. Dawn of the Dead.
Just a few of the dystopian, end-times shows I’ve seen where supermarkets are stars in their own right.
Depending on whether the shelves and fridges are fully stocked, bare, or broken, and whether the fluorescent lights are blinding, flickering, or gone, they convey a sense of impending (or existing) doom and a message that ordinary days are over.
It’s a visual trope, but a very effective one, especially when they prominently feature the clinical, glass-fronted freezer aisles, because supermarkets have become a ubiquitous symbol of daily life for most of us.
They represent convenience, normality, and familiarity. With rows and rows of food, they also promise us abundance. All of that is true even in developing countries like my own, where they have become a key part of our routines.
Maybe I need to stop watching them, because these images were the first things that came into my head as I read news of more cyberattacks hitting supermarkets.
(Warning: the clip below is quite gory.)
Who’s been affected?
The first of the recent attacks to be reported happened last month in France.
“Hackers gained control of the software that regulates the temperatures of the refrigeration units, forcing some to warm to 50C (120F) overnight, according to one supermarket chain affected,” the BBC reported.
Hundreds of supermarkets were hit; all were using software provided by the Danish engineering firm Danfoss, which allows retailers to manage their cold units remotely. Losses were estimated to be in the tens of millions of euros.
When I read the news, I was shocked: that a large-scale attack like this hadn’t happened earlier, that it was happening now (in the midst of a super El Niño that is set to wreck harvests), and that it would probably inspire copycats. Well, over the past few days, news broke of more such attacks:
At least six on-base commissaries belonging to the U.S. Army suffered freezer malfunctions in late August (but only now reported), and the Pentagon is treating them as a suspected hack, according to Reuters. Commissaries are on-base stores where military personnel buy their food.
In at least one instance, “the freezers did not simply stop working; the cooling units’ temperatures were cranked up overnight, yielding mounds of wilted or melted food in the morning”.
“Freezers at dozens of supermarkets across Europe suddenly overheated… after hackers broke into the refrigeration systems used by retailers,” said the FT, listing Sweden, Belgium, Ireland, Finland, and Estonia as countries that were affected. Again, the ruined food was worth millions of euros.
The article quoted the CEO of the Belgian refrigeration company Sabcobel saying hackers appeared to have taken advantage of equipment using unsafe internet connections. The head of a supermarket in Sweden said the store was unable to reset the system after hackers had changed the settings.
The Guardian/AFP has a helpful list of the supermarkets that were hit.
The Wall Street Journal said Germany, Italy, the Netherlands, Poland, and Romania were also attacked, with one store in Germany forced “to throw out a dumpster’s worth of dairy products”.
“Advancements in AI risk turbocharging the discovery of such vulnerabilities in the future,” it adds.
Who’s behind it?
Too early to say, according to news reports. Criminal investigations are ongoing and no one has claimed responsibility, and there appears to have been no ransom demand.
The Guardian suggested hackers linked to Russia and China could be the culprits. A cybersecurity expert told the paper the two most plausible scenarios are either “state-based signalling and demonstration of capability or some kind of lone-wolf hacker”.
Cybernews pointed out that Russia-linked hacktivist groups Z-Pentest Alliance and NoName057(16) have been actively targeting refrigeration systems since January 2026.
Al Jazeera reminded us of accusations that North Korea was behind the brazen $6.3 billion Binance cryptocurrency heist.
Whoever they may be, if these were deliberate attacks on the food supply, they suggest a particularly nihilistic mindset.
It is not yet clear whether these incidents are connected, or whether different actors independently identified similar vulnerabilities in these systems.
Why is it so worrying?
“Once a product that is meant to be refrigerated or frozen is out of the cold chain for 20 minutes, we do not sell that to customers as it is… not safe. All those products would be disposed of. Most likely through sending to anaerobic digestion plants,” one retailer told me when I approached them through Inside Track.
I’m sure the mileage varies depending on the retailer, but Errol Schweizer, a grocery industry veteran, a writer, a Thin Ink regular, and a member of the IPES-Food Expert Panel, agrees that food that is out for too long is unsafe.
“Most dairy products and a lot of perishable items, you need full cold chain integrity... Like leaving a pallet of meat out on a 90-degree (Fahrenheit, about 32°C) dock for more than a few minutes, that stuff is going to start turning very quickly,” he told me.
Maintaining cold chain integrity - keeping goods within specific temperature ranges throughout their distribution - has important food security implications, because we rely on cold chains more than ever. Consumers want more fresh and frozen food, while retailers see it as an added value, he said.
“Cold chain integrity is one of the greatest technology inventions of the 20th century. It changed the whole way we produce, and consume food, and it’s made fresh food a lot more available too, because a lot of the ultra processed stuff is shelf stable.”
I’ve also seen - and reported on - how cold chains have reduced food loss and waste along the value chain. We also saw their critical importance during COVID-19, when vaccines needed to be stored at very precise temperatures to maintain their potency.
Which is why the prospect of vast swathes of cold storage facilities suddenly going offline, becoming inoperable, or being hijacked is a nightmare scenario for many of us. Sure, the damage so far is spoiled food, but what if the same tactics become more widespread or reach warehouses and distribution centres?
Currently, nearly 13,000 refrigeration control systems in 99 countries and territories are vulnerable to attacks, cybersecurity company Forescout said in a blog.
Points to ponder
Will complacency threaten the food supply?
Per the WSJ: “The default administrator password for the Danfoss controller is set to “12345,” according to documentation on the manufacturer’s website. If a supermarket chain or its refrigeration contractor didn’t change the password, that would create a gaping security hole.”
It is not clear if the hacked refrigeration systems used the same password. Still…
Jonathan Braley, director of the threat intelligence nonprofit Food and Ag-ISAC, tells AgFunder that businesses should “enable multi-factor authentication (MFA) on everything related to the business: email, financial platforms, cloud applications, inventory and logistics systems, and remote access”.
Will LLMs make things worse?
Attacks on industrial hardware used to require specialised knowledge, but large language models “had made it easier for hackers to access the expertise and tools needed to hit multiple devices and sites at the same time”, Robert Lee, chief executive of cybersecurity company Dragos, told the FT.
Meanwhile, cybersecurity firm Claroty was able to build a test program to attack refrigeration systems in about 30 minutes using Claude, for a total cost of about $6, according to the WSJ.
Should food retail be considered critical infrastructure?
Errol thinks so.
“I’m definitely very worried about (these attacks). It’s just another reason why we need to start considering food as critical infrastructure and not just letting private sector institutions monopolise critical infrastructure.”
This from Forescout: “(The attacks) should prompt all government, military, and civilian security teams to reassess equipment still classified as ordinary facilities infrastructure. If a connected system can control a physical process, its access path is part of the cyber risk.”
Have we ceded too much control to the private sector and technological innovation?
Per the BBC: “Danfoss said the affected cold units were older models whose security software could not be updated to ward off a risk they had identified.”
So even if the equipment is fully functioning, do businesses need to buy new units, just to protect themselves from cyberattacks? Is this the food retail equivalent of Windows 10 or old iPhone software debacles?
Also, when software is sold as a service, you never really own it, and you will need to constantly ensure it is updated with the latest version. But what happens when there is staff turnover, ageing equipment, new ownership, and someone somewhere forgets to do that?
All this new technology is contingent on us constantly paying for new software and updates, and constantly being vigilant, Errol said. But “the CEOs are all enamoured of these technologies”.
Beyond this, even public institutions such as commissaries are still reliant on private sector wholesalers and brands, many of which are fixated on shareholder returns, profit, market concentration, and growth as opposed to feeding people, he added.
This means decisions are made with an eye towards margins, which often leads to cost-cutting by adopting technology that replaces a skilled workforce. See: self-checkout counters.
Can bringing back human staff help?
Bill Moore, the chief executive of industrial cybersecurity firm Xona Systems, told Reuters that the root problem was that controllers initially conceived as isolated interfaces serviced by in-person technicians were increasingly being connected to the internet.
Errol made a related point when we spoke.
“Coolers were pretty much fine if you had skilled, well-paid, well-scheduled staff checking them. I worked in many stores, and temp checks is a part of the job. Somebody goes around the store, inspects the coolers in their department, and keeps a log of what the cooler temps were. And if anything is in the danger zone, you address that immediately.
“The industry has always gone down the slippery slope of technology to reduce labour expenses for short term margin gains.
“There are certain things that you can say are nice to have like data assisted planning and inventory forecasting. I just feel that we’d be a lot better off if we had fully trained, staffed employees to do that, and that a lot of the decisions made weren’t being geared towards short term profit.”
Of course, staff checks and manual alarms add a layer of resilience, but might still not prevent attacks if they happen overnight.
To me, the attacks are about more than our retailers having secure passwords and up-to-date software. It raises questions on whether we have come to rely too much on technology and automation, what we lost along the way, whether we can find a rebalancing, and who is responsible for making sure the infrastructure that is critical for our well-being is safe and reliable.
Thin’s Pickings
If you’d like to join a lively discussion on food systems challenges, what we’re missing in our current approaches, and how to remedy that, a few spots are still available at this in-person event organised by food and farming NGO Rikolto. It is happening on 13 November 2026 in Leuven. I’ll be there.
The Guardian Australia is looking to speak to anyone (globally, not just Australia) who has been directly affected by industry tactics and are willing to share their story. The medical editor says you can be anonymous or speak only on background.
Email melissa.davey@theguardian.com or melissaleedavey@proton.me or Signal mdavey4.25.
Big Food’s battle to block sugar taxes - Follow the Money
I spoke to Emma du Chatinier about the European findings from our Big Food vs. The People investigation, in which Irene van den Bergh and I found that Europe is a laggard compared to Latin America on public health policies such as taxing health-harming foods and mandatory front-of-pack labelling.
Midterm hot takes
There are a lot, but I found these particularly interesting.
This short LinkedIn post by Alvaro Bedoya, former U.S. Federal Trade Commission commissioner, on what new members of Congress can do to deliver quick economic results
This Bluesky thread from climate journalist Ketan Joshi on the resounding rejection of data centres
Emily Atkin’s newsletter on how Big Oil spent big but gained little in return
My former colleague Melissa del Bosque wrote about the seismic results on Borderlands where not only will every border state have a Democrat as governor, three are female
As always, please feel free to share this post and send tips and thoughts on bluesky @thinink.bsky.social, my LinkedIn page, or via e-mail thin@thin-ink.net.
Really appreciate this invaluable summary. Clearly, food distribution way more vulnerable than many of us might have assumed.