Could cyberattacks on cold storage threaten Malaysia’s food supply?

 

On Oct 11, a strange and alarming crisis unfolded across 700 French supermarkets when hackers infiltrated refrigeration systems and manipulated temperature settings.

Rather than cooling perishable food, the compromised controllers were forced into a 50C defrost mode, resulting in millions of euros in damaged food stocks.

Less than a month later, supermarkets in Italy, Germany, Romania, and the United Kingdom, as well as France's national blood service, Établissement Français du Sang, reported similar incidents involving the manipulation of cold-chain control systems.

The incidents raised concerns over how vulnerabilities in seemingly mundane infrastructure, such as refrigerators, could have real-world consequences for food safety and supply chains, including in countries thousands of kilometres away that depend on similar systems.

For Malaysia, the developments carry particular significance given its heavy reliance on imported food, much of which depends on uninterrupted refrigeration and cold-chain logistics from overseas suppliers to local retailers.

Following the incidents, Prime Minister Anwar Ibrahim told the Dewan Rakyat that Malaysia could also be a potential target for cyberattacks, given its digital capabilities and position on certain international issues, particularly Gaza.

However, Anwar stopped short of advising Malaysians to make emergency preparations, stressing that the government was strengthening its preparedness and coordination to respond to possible threats.

While there is no indication of an imminent threat, the European incidents have raised questions about Malaysia's vulnerability to similar attacks and the potential consequences for its food supply.

Cyberattack plausible, but not imminent

Experts contacted by Malaysiakini said a cold-chain cyberattack in Malaysia was a real possibility, although there was currently no public evidence indicating that such an incident was imminent.

Cybersecurity experts Aaron Ikram Mokhtar and Murugason R Thangaratnam agreed that while the exact timing remained uncertain, Malaysia had specific vulnerabilities that could make its food supply chain susceptible.

Murugason pointed out that Malaysia's hot tropical climate made continuous refrigeration essential to the country's imported food supply. Official figures from the Statistics Department reveal that Malaysia's import dependency stands at 90.7 percent for mutton, 82.6 percent for beef, and 68 percent for cuttlefish.

Meanwhile, food processors, logistics providers, and major retail chains are rapidly digitising their operations and outsourcing remote system monitoring to third-party vendors.

Former Digital Ministry adviser Vicks Kanagasingam said this growing digitalisation, coupled with the rollout of 5G and private enterprise networks, was bringing industrial operational technology into closer integration with corporate IT systems.

This created remote access points into temperature monitoring, warehouse automation, and fleet dispatch systems that were previously less exposed.

“In this industry, the fundamental rule has always been straightforward: if it is connected to the internet, it is an attack surface.

“Attackers don't necessarily target Malaysia out of malice; they target exposed, high-bandwidth pathways,” Vicks told Malaysiakini.

Aaron, meanwhile, highlighted the risks posed by inadequate cybersecurity safeguards, particularly where refrigeration and other operational systems could be accessed remotely through third-party vendors.

Major food shortages unlikely

Despite these growing digital attack surfaces, supply-chain experts emphasised that Malaysia's food distribution network possessed considerable resilience, making a cyberattack highly unlikely to trigger nationwide food shortages.

SME Association of Malaysia president Chin Chee Seong noted that digital exposure varied significantly across the supply chain.

While major hypermarket chains and modern logistics hubs rely on digital warehouse management systems, many smaller cold-storage retailers continue to use conventional refrigeration systems governed by local, manual controls.

This decentralised arrangement could help shield Malaysian consumers from widespread food shortages in the event of a cyberattack.

SME Association of Malaysia president Chin Chee Seong

“We are not dependent on a single centralised facility. If one becomes inoperable, affected businesses may redirect products to alternative warehouses,” Chin said.

Consumers' Association of Penang (CAP) president Mohideen Abdul Kader echoed this perspective, highlighting that traditional retail channels, such as neighbourhood wet markets and small grocers, serve as a vital buffer for everyday food access.

These traditional vendors typically rely on shorter, localised supply chains, conventional freezers, or insulated ice boxes, making them less vulnerable to remote cyber tampering.

Mohideen added that since reports of the European attacks emerged, CAP has not observed any consumer panic, stockpiling, or unusual complaints regarding food availability.

Improve gaps in digital food security

Although experts did not consider a cyberattack imminent, they said Malaysia should strengthen its preparedness before a disruption occurs, particularly by addressing gaps in operational safeguards and emergency coordination.

Murugason said Malaysia had made progress through the Cyber Security Act 2024 and its national cybersecurity strategy, but food distribution and cold-chain infrastructure were not explicitly identified among the country's 11 critical sectors.

He called for the government to map critical cold-chain operators and their dependencies, clarify which facilities and third-party service providers fall under cybersecurity requirements, and introduce operational technology-specific risk assessments and incident reporting.

“Above all, compliance is not resilience: a completed assessment does not prove a cold store can keep food safe when its controllers fail,” Murugason said.

Cybersecurity expert Murugason R Thangaratnam

Aaron similarly urged the National Cyber Security Agency (Nacsa) and CyberSecurity Malaysia to strengthen threat-sharing and establish clearer cybersecurity requirements for privately operated facilities and third-party refrigeration vendors.

Nacsa coordinates national cybersecurity policy and the response to threats involving critical information infrastructure, while CyberSecurity Malaysia provides technical cybersecurity services and expertise.

At the operational level, both cybersecurity experts stressed the need to audit remote access, patch outdated systems, and separate refrigeration controls from corporate IT networks. They also called for independent temperature monitoring, manual overrides, and regular emergency exercises to ensure facilities could continue operating if digital systems were compromised.

“Think of commercial aviation: when automated flight control systems act erratically, the pilot disengages autopilot and flies the aircraft by hand.

“Operations teams across critical sectors must be trained on 'analogue resilience' - the discipline to run physical supply chains during a digital blackout,” Vicks said.

Beyond cybersecurity measures, Chin said the government should work with industry players to identify alternative cold-storage facilities, emergency capacity, and backup transportation routes. Smaller businesses should also receive targeted financial and technical assistance to strengthen their cybersecurity.

For consumers, Chin and Mohideen urged Malaysians not to panic or stockpile groceries in response to the European incidents.

Instead, households should maintain modest emergency food supplies, while the government should provide timely and transparent updates during any disruption to prevent rumours and unnecessary panic buying.

“Clear communication on any potential risks and the measures being taken to address them can help people stay prepared and make informed decisions without creating unnecessary fear, panic buying, or hoarding,” Mohideen said. - Mkini