A cyberattack targeting French supermarkets has highlighted how vulnerabilities in shared OT systems can expose hundreds of locations to risk simultaneously.
Floris Dankaart-Chang, Associate Director, Portfolio Strategy at NCC Group, commented:
“What makes this attack in France remarkable is not just that hackers were able to manipulate cooling systems or that food distribution networks were targeted. The attack on French supermarkets demonstrates, above all, how hundreds of individual locations can, without anyone noticing, form a single digital attack surface, simply because they use the same systems. Whilst this brings efficiency, it also creates a shared risk: an unpatched vulnerability or an outdated system can therefore affect several shops at once.
This incident demonstrates (once again) that attacks on OT / ‘Cyber-Physical Systems’ are not fiction but fact. It also shows that cyber hygiene measures, such as changing default login credentials, enforcing strong passwords, disconnecting such systems from the internet and, where possible, patching known vulnerabilities, can already make a significant difference. Continuous monitoring, using passive sensors amongst other methods, is a logical next step.”
"Wat deze aanval in Frankrijk interessant maakt, is niet alleen dat hackers koelsystemen konden manipuleren of dat voedseldistributie wordt aangevallen. Het laat vooral zien hoe honderden afzonderlijke locaties ongemerkt één digitaal aanvalsoppervlak kunnen vormen, omdat zij gebruik maken van dezelfde systemen. Dat levert efficiëntie op, maar creëert ook een gedeeld risico: een ongepatchte vulnerability of verouderd systeem kan daardoor gevolgen hebben op veel meer plekken dan één winkel.
Dit toont in ieder geval (opnieuw) aan dat aanvallen op OT / Cyber Physical Systems geen fictie maar feit zijn. Het laat ook zien dat hygiënemaatregelen, zoals het vervangen van default credentials, het loskoppelen van dit soort systemen van het internet en waar mogelijk het patchen van bekende vulnerabilities al veel kunnen helpen. Vervolgens is continue monitoring door middel van onder meer passieve sensoren een logische vervolgstap."
Floris Dankaart-Chang biography
Floris Dankaart-Chang is Associate Director, Portfolio Strategy at Fox-IT (an NCC Group subsidiary), owning and leading the global portfolio strategy, roadmap, and execution for NCC Group’s Managed Extended Detection & Response (MXDR) services.
Floris is based at Fox‑IT in the Netherlands, operating as part of the Fox‑IT senior leadership team to support enterprise clients with proposition, service, and technical expertise. He is responsible for aligning MXDR with adjacent cyber security services, driving market differentiation, product evolution, pricing models, and performance metrics across a highly competitive market.
In previous roles, Floris was responsible for NCC Group's Managed Extended Detection & Response service based on Splunk technology as well as the Managed Canary (Honeypot) and GMS OT services.
