When cyber attacks target the real world, not the data

Here, cyber security expert, Dr Asma Adnane, discusses the significant blind spot in many organisations' cyber security strategies and raises important questions about risk management, accountability and resilience.

"Following any cyber attack, the most important question is 'was this vulnerability already on someone's risk register?'

"In the recent attack on French supermarkets' refrigeration systems, public reporting suggests vulnerabilities affecting the controllers had been disclosed months before the incident (Claroty's Team82). If that is the case, organisations should be asking some difficult questions: Was the risk identified? Was it assessed properly? And, most importantly, was it prioritised for action?

"The consequences of getting those decisions wrong can be significant. In this case, the disruption reportedly led to food losses worth millions of euros."

More than a cyber security problem

"What makes this incident particularly interesting is that it highlights a broader issue than technology alone. This was not just a cyber security problem. It was a governance problem.

"The retailers pointed to the supplier. The supplier pointed to ageing equipment. In reality, responsibility was shared, but accountability appeared unclear.

"That is becoming an increasingly common challenge as organisations rely on third parties to manage and maintain business-critical operational systems. When ownership of security responsibilities becomes blurred, vulnerabilities can persist for years without being addressed."

Why operational technology matters

"Operational technology controls the physical systems organisations depend on every day. Historically, these systems have received less attention than traditional IT assets because they rarely store customer data or financial information, so their vulnerabilities are given a lower priority than risks involving data breaches.

"That can be a costly mistake.

"Attackers do not always need to steal data to create disruption. Shutting down equipment, interrupting services or affecting supply chains can cause significant financial, operational and reputational damage."

An overlooked weakness

"Often, operational systems can sit outside of many organisations' mainstream cyber security efforts - being run by legacy technologies and are not monitored to the same standard as IT systems. Many cyber security reports* support this view - showing that operational technology is poorly visible and becoming increasingly targeted, and that critical infrastructure resilience is a growing concern for organisations and governments."

Resilience must become a priority

"No organisation can guarantee it will never experience a cyber incident. The real measure of resilience is how well it prepares for one.

"This means understanding what operational assets exist, identifying dependencies, continuously assessing vulnerabilities, and prioritising remediation according to business impact, whilst also ensuring that critical services can continue to operate safely during a disruption.

"The lesson from this incident is simple: organisations need to treat operational technology as a business risk, not just a technical one. If a cyber attack can stop products being made, food being sold or services being delivered, cyber security is no longer just an IT issue."

ENDS

For further comments or interview requests with Dr Asma Adnane, please contact the PR Team or call 01509 222224.