In the early 2000s, a deliberate cyberattack on an industrial control system marked one of the first widely known instances of digital manipulation causing physical disruption when a former contractor tampered with sewage controls in Maroochydore, Queensland, Australia, releasing 800,000 litres of raw sewage into public areas. More than two decades later, similar vulnerabilities continue to threaten critical infrastructure, as evidenced by recent reports of hackers infiltrating refrigeration systems in French supermarkets, leading to widespread food spoilage across hundreds of stores.

These incidents underscore the increasingly intertwined nature of digital systems and physical supply chains, illustrating how software weaknesses can directly impact food security as well as other sectors such as water management, healthcare, transportation, finance, and energy. The French supermarket case reportedly involved older management systems no longer receiving security updates, despite the supplier’s assertions that customers had been encouraged to upgrade to more secure platforms. This raises questions about the extent of vendor responsibility in maintaining software security for systems vital to societal functions, particularly when companies phase out support for legacy products.

Supermarket operators also face scrutiny regarding risk awareness and mitigation strategies. Industry experts highlight a pattern of normalized acceptance of insecure software, contrasting it with robust regulatory and investigative responses seen in other industries when failures occur, such as aviation or pharmaceuticals. Unlike these sectors, software vulnerabilities have often been regarded as an unavoidable reality, a stance reflecting broader market dynamics prioritizing affordability, functionality, and speed over resilience.

The United Kingdom is among the governments beginning to address this issue more systematically. Its voluntary Software Security Code of Practice establishes baseline security expectations for vendors, while proposed legislation aims to empower regulators to designate certain providers of essential digital services as “critical suppliers,” subjecting them to mandatory cybersecurity requirements. Corporate boards are increasingly expected to integrate cybersecurity considerations into governance frameworks, treating digital risk management with the same rigor as financial oversight.

Despite the challenges, cybersecurity investments carry significant trade-offs, especially for supermarkets operating on narrow profit margins and facing consumer sensitivity to price increases. Yet, the potential fallout from coordinated attacks that disrupt the cold chain—including refrigerated warehouses, transport vehicles, and distribution centers—extends well beyond individual companies, threatening broader food system stability. This interconnectedness indicates that a collective approach is necessary to build resilience.

Emerging technologies, such as artificial intelligence-driven security tools, offer potential to improve vulnerability detection and remediation in cost-effective ways. The recent episode of food spoilage in France was not due to traditional supply chain disruptions like poor harvests or transportation issues but rather to a digitally rooted weakness embedded within the infrastructure itself. Addressing this dependency requires more than incremental fixes; it calls for a reassessment of design choices, maintenance practices, regulatory frameworks, and commercial incentives to better safeguard critical systems that underpin society’s essential services.