See more Toronto Sun on Google — save as a Preferred Source

A second wave of suspected cyberattacks on European supermarkets has exposed a vulnerability that Canada’s food industry should take seriously. Grocery stores in at least nine countries reported refrigeration failures. One Swedish supermarket said its refrigeration systems had been remotely set to 50°C. Across the affected stores, tonnes of food had to be thrown out. An earlier wave had already hit stores in France, Belgium and the Netherlands.

The economics explain why refrigeration is such an attractive target. Fresh food has a limited shelf life, and grocers and processors depend on a steady flow of deliveries. A few hours of disruption can mean discarded inventory, missed shipments and lost sales. Even when the equipment comes back online, a grocer may still have to discard products if it cannot establish how warm they got or for how long.

The same vulnerability exists in Canada. A cyberattack can force a company to replace inventory, reroute shipments and pay for emergency repairs. Over time, repeated disruptions and higher spending on cybersecurity can put upward pressure on food prices. How much reaches the checkout depends on competition and on who has the bargaining power to pass those costs along.

Ransom is one possible motive. With perishables, attackers have leverage because the cost of waiting rises by the hour. Paying can encourage further extortion, while refusing can leave a company absorbing a substantial loss. The European incidents also raise the possibility of deliberate disruption for its own sake. Public frustration with grocery prices is real, but it tells us little about who was behind these attacks or what they wanted.

Cybersecurity deserves place alongside food safety

For years, cybersecurity barely registered at many food industry conferences. It deserves a place alongside food safety. Refrigeration is the obvious example, but a breach at a processing plant could also interfere with ingredient controls, allergen labelling or the records needed to trace a contaminated batch. Automation helps companies run more efficiently. It also makes it more important to know who can access production controls and how quickly staff can intervene when something goes wrong.

Major grocers and manufacturers are already investing in more resilient facilities and systems. The harder question is what happens when they ask their suppliers to meet the same cybersecurity standards. A national retailer can spread the cost of monitoring, audits and staff training across hundreds of stores. A family-owned processor with a single plant has far less room to absorb those costs. Losing a major retail account over a requirement it cannot afford could put an otherwise viable business at risk.

  • CHARLEBOIS: A price freeze that doesn’t freeze your grocery bill
  • CHARLEBOIS: When the clocks change, food habits follow
  • CHARLEBOIS: Supply management’s chicken import racket?

Canada’s largest grocers have enough influence to set cybersecurity standards across much of the food supply chain. They can also help suppliers meet them. Common requirements, shared training and technical support would make it easier for smaller processors to protect their operations without paying for a separate compliance program for every major customer.

Perishability gives attackers a deadline they can use against any food company. A grocer can invest heavily in protecting its own warehouses and still lose a shipment when a supplier’s plant goes down. Helping that supplier stay operational is part of protecting the grocer’s own business.

— Sylvain Charlebois is director of the Agri-Food Analytics Lab at Dalhousie University, co-host of The Food Professor Podcast.