Why Boards Should Care About France’s Fridge Attack | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware

On October 11, across France, consumers were surprised to find their markets closed as a result of an attack against….their refrigerators. 
Around three hundred Intermarché and Netto stores were remotely manipulated to heat up. Cabinets pushed up to fifty degrees, stock ruined across the country, small fires in several of the stores.  Attackers did it by triggering the units’ defrost function, though we have yet to learn who or what the cause was.
When we think about bad actors targeting a nation we rarely think of spoiled milk, but whatever happened October 11 was another stark example that the end goal may not always involve data, or a ransom – but it is always about impact.  The chief executive of Intermarché went on television and said tens of millions of euros, nationwide, in a day.
I have been saying for a while now that downtime is the new breach and this was yet another reminder.
Why a fridge, though?
Whether it was a nation state, a kid on the Internet or organized crime, we rarely wake up thinking about embedded/IoT in the kitchen (or in this case, the market) as the high-risk area in our lives.  A refrigerator is possibly the most boring piece of resilience engineering on earth. And yet, impact the food supply chain for a nation and now you get the point.
There are few parts of daily consumer life, be it food and water, electricity, transportation, shelter that could not face a similar disruption.   We have decades of automation and embedded aging tech, a newly minted massive wave of AI discovered and reported vulnerabilities, and many eager participants also using AI to work out how to turn those vulnerabilities to their own purpose.
The cost of Downtime
A year ago last month Jaguar Land Rover stopped building cars for about six weeks and every headline that week was about the cyber attack.  Who did it, how they got in, which crew claimed it.  But the attack did not keep JLR down for six weeks.  Their ability to restore operations, their resilience, was what drove the timeline.
An intrusion is an event.  It happens generally in a brief window.  Six weeks of stopped production  was not the cyber event, but the event recovery that cost £196 million in cyber-related costs in a single quarter, on top of a £485 million operating loss driven by the production halt itself.  That is also the part that had the British government guaranteeing a £1.5 billion loan at the end of September 2025 to save the suppliers, who had no orders coming for six weeks and no balance sheet to wait it out on.
The end cost of the October 11 attack on the European food supply will be driven by how quickly these entities can replace product, get new or repaired cooling systems, and whatever else in cleanup is required. 
Are we Resilient?
These are not small or unsophisticated businesses, so I would imagine their boards had many cyber related discussions.  My observation though has been that most boards discuss cyber and risk as a part of compliance and audit, not their overall resilience as a business. 
A few years ago, I would have said that having cyber expertise on boards were useful for bridging the understanding between the deeply technical risk topics and getting comfort on whether the company was responsibly managing the risk. 
Today, however, I would say the criticality of having a board level understanding of the new risk landscape cannot be optional, nor should it be only technical.  This is an operations discussion.   You are not trying to understand the technical risk, you are looking to ensure you can withstand and endure the impact that could result from it.
Boards ask the CISO to read out on risk, but they should be asking the management team to comment on resilience.  Threat landscape, incidents, controls, audit findings, the heat map.  Good conversation.  Should happen.  
But more rarely do I see boards asking the team to read out on resilience and provide evidence that the management team has looked at what could really disrupt the business and taken adequate precautions.
Impact metrics matter
So, as a board, how do we change the conversation? Pivot the discussion to impact and resilience.
Rather than scorecards and pen-tests, boards need to understand what the company can tolerate and help guide investment to a risk level that fits.  One example can be found in the UK.  Since March of last year, UK financial firms have had to name what the regulator calls an impact tolerance.  The maximum tolerable disruption to an important business service, measured as a length of time: the number of hours, per service, that the team has to prove it can live inside.
Being protected is not the same as being resilient.
 

Join our LinkedIn group Information Security Community!

——————————————————-
Click Here For The Original Source.

Related