A cyberattack on Sunday hit hundreds of French grocery stores, ERR News reports. The attackers turned the refrigerators up to as high as 50 degrees Celsius, so large quantities of food were spoiled and the stores lost money. Who was behind it, and whether a ransom demand will follow, was still unclear.
Toomas Lepik, a cybersecurity analyst at Tallinn University of Technology, told ERR that the threat is very real for Estonia as well. To his knowledge nothing like it has happened in Estonia, but mistakes or poor cyber hygiene could make it possible.
Liisa Pakosta, the minister of justice and digital affairs, called the incident shocking and said cyberattacks are no longer limited to computers and information systems. She said Estonia already sets especially strict cyber rules for providers of vital services, food security among them, and that the larger companies responsible for food security have to be audited. Her advice to companies was direct: "Companies need to ensure their software is up to date, that systems are properly connected
". The requirements do not apply to every grocery store.
The supermarket chain Selver said it has had no incident of this kind and is following the French case. Its communications manager Mariann Järvela compared the consequences with a power outage, for which the chain already holds emergency exercises.
Source: ERR News, . The text above is our own summary; the words in quotation marks are the source's.
What this means for an Estonian entrepreneur
The attack did not stop at office computers: it reached refrigeration equipment connected to a network. For an Estonian company the practical question is which of its devices — cooling, heating, alarms, payment terminals — can be reached from the internet, who updates their software and whether operations can continue during an outage. A company that supplies food producers or retailers should expect its customers to ask the same questions in writing.
Before you sign a maintenance or supply contract for connected equipment, we can review whether it says who updates the software and who answers for its security. Review of a lease or other contract