Are you asking the right questions about cybersecurity?

If you doubt that cybersecurity is an operational priority, consider what happened to French grocers in October.

Hackers remotely manipulated refrigeration systems in hundreds of supermarkets, raising temperatures to 50 C. Food spoiled, fires broke out and some stores were forced to close temporarily. Industry-wide losses were predicted to be tens of millions of euros. 

And less than a month after that attack, grocery store freezers in several other European countries were targeted with similar ramifications.

Few hacks grab global headlines, but costly breaches are happening everywhere, all the time. One in six Canadian businesses were affected by a cybersecurity incident in 2025, according to Public Safety Canada’s biennial Canadian Survey of Cyber Security and Cybercrime, while other surveys paint an even grimmer picture. IBM’s latest Cost of Data Breach Report pegged the average financial toll per incident in Canada at $7.1 million, including recovery, business disruption and investigation costs. Stolen customer data can compound those losses with lawsuits and reputational damage. None of these figures are grocery-specific, but their implications are undeniable.

For grocers, the exposure stretches beyond credit card information and customer databases to internet-connected freezers, warehouse automation, delivery platforms and supplier networks. Meanwhile, artificial intelligence is helping cybercriminals identify security vulnerabilities and convincingly impersonate colleagues, suppliers and even the authorities. Largely gone are the days when phishing emails were betrayed by bad grammar and awkward phrasing.

What should grocery leaders do? Treat cyber resilience as a matter of food safety and business continuity, not merely an IT expense. That doesn’t mean you need to become a cybersecurity expert (unless, of course, you’re the head of cybersecurity). But you do need to know the right questions to ask—and to develop a nose for good answers.

Those abilities might have helped in France, where some refrigerators failed not because of neglectful execs or IT teams, but because they were too old to receive the necessary software update. Asking whether all patches have been applied is not the same as asking whether all vulnerable fridges have been patched.

That said, no cyber defense is foolproof. So, perhaps the most important question isn’t, “How are you defending against hackers?” but, “How will you safeguard and serve your customers when hackers succeed?”

This is an adapted version of an article first published in Canadian Grocer’s November 2026 issue.