What the Albert Heijn hack teaches us about OT security

Last week, the Netherlands was suddenly turned upside down: Albert Heijn had been hacked.

The bonus offers didn't work. Distribution centers were disrupted. Online orders were not delivered. CEO Margaret Versteden-van Duijn had to justify herself on talk shows, while everyone wondered: how can a single cyberattack have such a significant impact on daily groceries?

In the same week, hundreds of supermarkets in France were hit by an attack on their refrigeration systems. Hackers forced cooling and freezing units to defrost, causing fresh and frozen products to spoil.

No bitterballen in your French holiday home, due to a hacked fridge.

At first glance, these appear to be primarily IT incidents. However, in modern distribution centers and retail chains, the boundary between IT and OT is razor-thin. Software for planning, inventory management, and order processing is often connected to scanners, sorting systems, conveyor belts, and refrigeration units.

When digital controls fail, it affects physical processes. Goods are not processed, orders are delayed, and logistics chains are disrupted.

That is exactly where the most important lesson lies.

The hack at Albert Heijn reveals how dependent society has become on the digital systems behind our food supply. The attack on the French refrigeration units went a step further. There, not only data or software were affected, but physical processes as well. Resulting in rotting bitterballen.

For customers, however, it makes little difference whether an incident originates in IT or OT. They only notice that the groceries are not being delivered and the loyalty card does not work.

Ultimately, cybersecurity is not about technology.

It is about continuity.

On the question of whether a factory keeps running. Whether a distribution center keeps functioning. Whether a refrigerator keeps cooling. Whether the shelves are full.

And if a hacked refrigerator can make the news, then perhaps it is time to stop viewing OT security as a technical specialty and start as a governance issue.

By: Alois Hogenbirk, Project Manager Markets FHI