What a decade of food-sector cyberattacks reveals about AI operating systems
By Jon W. Hansen, FCIPS | Procurement Insights · November 2026
This week, David Shillingford tagged me in a post about cyberattacks on supermarket refrigeration. On 2 November, attackers changed the settings on refrigeration controls in stores across Sweden, Belgium, Luxembourg, Ireland, Estonia and the Netherlands, setting some freezers to 50°C. It followed an attack in October in which refrigeration systems in hundreds of French supermarkets were sent into unusual defrost cycles with food still inside. David’s checklist was sound: inventory every connected device, segment the networks, remove default credentials, restrict vendor remote access, and add an independent monitoring layer that can detect an abnormal command.
I added one question: what happens after the monitor detects it?
A freezer-temperature spike is not only a cyber event. It crosses facilities, vendor remote access, food safety, inventory, logistics, insurance and regulation, usually under different owners, systems and contracts. Someone has to sever access, override the controller, move the product and decide whether it can still be sold, and all of it has to happen before the temperature crosses the line.
One case at a time, every incident looks different
The pattern below is drawn from confirmed incidents. The two from 2026 are included as current illustrations, and one of them is still unconfirmed.
Target, 2013: attackers came in through credentials stolen from a refrigeration contractor.
Mondelēz, 2017: NotPetya, an attack aimed elsewhere, spread across sales, distribution and finance networks and delayed shipments.
Americold, 2020 and 2023: the freezers kept working, but inventory and order systems went down, and customers could not retrieve their product.
JBS, 2021: one company’s ransomware incident became a national meat-supply risk.
Schreiber Foods, 2021: a cyber incident crossed milk, labor, trucking and packaging strands already under stress, and helped produce a cream-cheese shortage.
Dole, 2023: ransomware disrupted production, and retailers reported shortages of salad kits.
Europe, 2026: the refrigeration controller itself became the weapon. In France, supermarkets commonly outsource refrigeration to third parties and cannot manage its security themselves.
U.S. military commissaries, 2026: the Pentagon is treating late-August freezer failures, in which units switched into defrost mode overnight, as a suspected cyberattack. The cause has not been confirmed.
Read one at a time, these look like eight problems needing eight fixes.
How past attacks shaped the strands to watch. Each strand is on the list because a real incident showed it could fail.
Side by side, three strands recur
Strand Commonality™ shows that, side by side, the same three strands appear in almost every incident:
A pathway in: how the attack got in or spread. A contractor’s credentials, a remote monitoring system, a network an attack moved across. The door changes every time.
A clock: how long until the product, or the ability to deliver it, is lost. In food, every one of these incidents became a race against shelf life, or against getting product to customers.
The authority to act: who could sever access, override equipment, move inventory or decide disposition, and how quickly.
Detection is separate from all three. It is the moment the clock becomes visible. On 2 November, one attack began in the early hours but was only noticed hours later, and every one of those hours came off the clock.
The door changes. The deadlines and the decision owners differ from one incident to the next; the need to establish both does not.
What the public record shows less clearly is how much authority decided the size of each loss. Permission does not create a backup freezer, a refrigerated truck or a clean inventory record. So the question is not whether authority existed, but whether clear authority and an executable response could have reduced the loss within the available window. That is the question our lab will test.
Sequential handoffs vs. synchronized strand response. On the left, the alert passes from function to function while the temperature rises. On the right, authority defined in advance lets every strand act before the threshold. Illustrative, not measured data.
How to get from the left side to the right
The answer is not another system. It is three steps, taken before the incident:
Trace the real response chain, not the documented one. Who actually holds the refrigeration vendor’s access? Who can authorize moving product to another facility at 3 a.m.? Which carrier answers the phone? The chain usually runs outside the company.
Define who may act, and within what limits, before anyone needs to. In our architecture, that boundary is called the Firm Fence: what may happen automatically, what needs more reasoning, and where a person must decide.
Rehearse it against the product’s actual clock. A tabletop exercise that tests the documented plan tests the wrong thing. It should test the real chain, including suppliers and workarounds, against the time the product actually gives you.
That is the work Phase 0™ is built to do.
Counting attacks is not the same as tracing losses
This is not the only cross-incident analysis of food-sector cyberattacks, and it is not meant to replace the others. The Food and Agriculture ISAC does essential work: its report on 2025 analyzed 6,377 ransomware incidents across sectors, including 265 against food and agriculture, examining the groups responsible, the vulnerabilities they exploited and the countries targeted.
That work asks who attacks, and how. Strand Commonality™ asks a different question: what turned the attack into a loss?
What an AI operating system adds, and when its authority is tested
In October, McKinsey described an “AI operating system” for the enterprise: a management layer that works like a second brain, built on a semantic layer of the enterprise’s entities, relationships, policies and business logic. To be fair to it, McKinsey’s model is not only about knowledge. It tells leaders to redesign decision rights: which decisions agents can make, which need human judgment, and when to escalate. In its own example, leaders agree that there will be “no withdrawals without CEO approval,” and the system records that decision as a guardrail. And one manufacturer tied its agents’ performance to business outcomes, to test whether the system had captured the business correctly.
Applied to a cold-chain attack, that architecture would add real value. It could connect a temperature reading to the affected batches, model the options and route the decision faster than any person could.
So the difference is not that one architecture governs authority and the other does not. It is when, and against what, that authority is tested.
An AI operating system, as McKinsey describes it, codifies decision rights from the enterprise’s understanding of itself, then tests that understanding through outcomes after it is running.
ARA™ RAM 2025™ running on SLAP OS™ establishes them first, against how the operation actually runs, including the dependencies outside the enterprise, before anything is codified.
That difference matters most in exactly this kind of incident. The authority a cold-chain attack needs often belongs to someone else: the refrigeration contractor who manages the controls, the cold-storage provider holding the product, the carrier with the only available truck. Codifying decision rights does not validate them. If they were never traced against the real chain, the system will enforce the documented picture, faster.
And the dependency runs one way. In 1998, at the Department of National Defence, there was no AI operating system in today’s sense. Next-day delivery rose from 51% to 97.3% in three months because we traced how the operation actually ran, defined who could act, and fed every outcome back into the next decision. An intelligence layer depends on that operating foundation. The foundation does not depend on any particular intelligence layer. If the foundation is wrong, a second brain organizes the wrong understanding, and acts on it faster.
This is also where the AI operating system idea came from, at least in our work, and the record is dated. The Metaprise™ model, first set out in 1999, drew enterprise applications as a sequential chain, supplier to manufacturer to reseller, and set against it a synchronous architecture coordinating every participant through a shared hub. In the fall of 2004, in a paper titled Acres of Diamonds, I wrote: “It is my position that a true centralization of procurement objectives requires a decentralized architecture that is based on the real-world operating attributes of all transactional stakeholders starting at the local or regional level. In other words, your organization gains control of its spend environment by relinquishing centralized functional control in favor of operational efficiencies on the front lines. This is the cornerstone of agent-based modeling.” In July 2007, I defined it in print as a synchronized rather than sequential architecture linking all transactional stakeholders in real time, with the buyer engaging suppliers, courier companies and customs brokers at once. In December 2007, I wrote that technology designed outside an agent-based model would never reliably establish “the streams of commonality that are driven and defined by real-world processes.” In October 2024, I distinguished technology-led agentic AI from human-led, agent-based models; a week later, I wrote about the birth of the AI operating system, and of agent-based AI operating systems extending to suppliers, couriers and customs. That was almost two years before the term reached the consulting mainstream. The vocabulary changed over 25 years. The architecture did not: the hub, the external stakeholders, the streams of commonality, and the human-led sequence, with technology last.
That is why Phase 0™ matters more in the AI era, not less. A sequential chain contained a misunderstanding at each handoff. A synchronous operating system carries it to every participant at once, so the understanding at its center has to be right before anyone connects to it.
Putting the pattern to the test
Eight incidents are a pattern, not a proof. Before publishing this, we opened a new lab, the Cold Chain Strand Lab, and locked its rules before the search began.
The Cold Chain Strand Lab: rules fixed before the search
Hypothesis: in cyber incidents that disrupt the food supply chain, a pathway in, a clock and the authority to act appear in almost every case.
Sample: confirmed cyber incidents since 2010 that disrupted food production, storage, distribution or retail availability, documented by established sources. The eight cases above generated the hypothesis, so they are reported separately and do not count toward the result.
Evidence: the clock counts only where a deadline or deterioration window is documented; authority counts only where the record documents who acted, escalated, delayed or could not act. Where authority is inferred rather than documented, it is recorded separately and excluded from the result. Unknown is never counted as present.
Scoring: one organization per incident, scored independently of the analysis that proposed the hypothesis, with disagreements recorded.
Thresholds: 80% or more, the hypothesis holds; 60% to 79%, it holds in part, and the strands that fall short are named; below 60%, it is rejected, and that result is published as it stands.
Scope: a rejection would reject this hypothesis in this sample, not the method behind it.
Fingerprinted: the rules and the amendment that sharpened them were fingerprinted before the search, so anyone can confirm they were not changed afterward.
Most analysis publishes what happened. We are publishing, in advance, what would prove us wrong. The results will follow in a separate post.
Truth Is Believing. Accuracy Is Knowing. Outcome Is Proof.™
-30-
References
David Shillingford, LinkedIn post on cyberattacks targeting refrigeration control systems, November 2026. [Link]
Sources for the incident table: Krebs on Security (Target); company SEC filings (Mondelēz, Americold, Dole); FBI (JBS); Wisconsin Public Radio (Schreiber).
The Map You Design and the Map You Trace, Procurement Insights, 29 July 2026 (the full account of the 1998 DND engagement). [Link]
In Food-Sector Cyberattacks, the Door Changes. The Clock and the Authority Do Not.
Posted on November 4, 2026
0
What a decade of food-sector cyberattacks reveals about AI operating systems
By Jon W. Hansen, FCIPS | Procurement Insights · November 2026
This week, David Shillingford tagged me in a post about cyberattacks on supermarket refrigeration. On 2 November, attackers changed the settings on refrigeration controls in stores across Sweden, Belgium, Luxembourg, Ireland, Estonia and the Netherlands, setting some freezers to 50°C. It followed an attack in October in which refrigeration systems in hundreds of French supermarkets were sent into unusual defrost cycles with food still inside. David’s checklist was sound: inventory every connected device, segment the networks, remove default credentials, restrict vendor remote access, and add an independent monitoring layer that can detect an abnormal command.
I added one question: what happens after the monitor detects it?
A freezer-temperature spike is not only a cyber event. It crosses facilities, vendor remote access, food safety, inventory, logistics, insurance and regulation, usually under different owners, systems and contracts. Someone has to sever access, override the controller, move the product and decide whether it can still be sold, and all of it has to happen before the temperature crosses the line.
One case at a time, every incident looks different
The pattern below is drawn from confirmed incidents. The two from 2026 are included as current illustrations, and one of them is still unconfirmed.
Read one at a time, these look like eight problems needing eight fixes.
How past attacks shaped the strands to watch. Each strand is on the list because a real incident showed it could fail.
Side by side, three strands recur
Strand Commonality™ shows that, side by side, the same three strands appear in almost every incident:
Detection is separate from all three. It is the moment the clock becomes visible. On 2 November, one attack began in the early hours but was only noticed hours later, and every one of those hours came off the clock.
The door changes. The deadlines and the decision owners differ from one incident to the next; the need to establish both does not.
What the public record shows less clearly is how much authority decided the size of each loss. Permission does not create a backup freezer, a refrigerated truck or a clean inventory record. So the question is not whether authority existed, but whether clear authority and an executable response could have reduced the loss within the available window. That is the question our lab will test.
Sequential handoffs vs. synchronized strand response. On the left, the alert passes from function to function while the temperature rises. On the right, authority defined in advance lets every strand act before the threshold. Illustrative, not measured data.
How to get from the left side to the right
The answer is not another system. It is three steps, taken before the incident:
That is the work Phase 0™ is built to do.
Counting attacks is not the same as tracing losses
This is not the only cross-incident analysis of food-sector cyberattacks, and it is not meant to replace the others. The Food and Agriculture ISAC does essential work: its report on 2025 analyzed 6,377 ransomware incidents across sectors, including 265 against food and agriculture, examining the groups responsible, the vulnerabilities they exploited and the countries targeted.
That work asks who attacks, and how. Strand Commonality™ asks a different question: what turned the attack into a loss?
What an AI operating system adds, and when its authority is tested
In October, McKinsey described an “AI operating system” for the enterprise: a management layer that works like a second brain, built on a semantic layer of the enterprise’s entities, relationships, policies and business logic. To be fair to it, McKinsey’s model is not only about knowledge. It tells leaders to redesign decision rights: which decisions agents can make, which need human judgment, and when to escalate. In its own example, leaders agree that there will be “no withdrawals without CEO approval,” and the system records that decision as a guardrail. And one manufacturer tied its agents’ performance to business outcomes, to test whether the system had captured the business correctly.
Applied to a cold-chain attack, that architecture would add real value. It could connect a temperature reading to the affected batches, model the options and route the decision faster than any person could.
So the difference is not that one architecture governs authority and the other does not. It is when, and against what, that authority is tested.
That difference matters most in exactly this kind of incident. The authority a cold-chain attack needs often belongs to someone else: the refrigeration contractor who manages the controls, the cold-storage provider holding the product, the carrier with the only available truck. Codifying decision rights does not validate them. If they were never traced against the real chain, the system will enforce the documented picture, faster.
And the dependency runs one way. In 1998, at the Department of National Defence, there was no AI operating system in today’s sense. Next-day delivery rose from 51% to 97.3% in three months because we traced how the operation actually ran, defined who could act, and fed every outcome back into the next decision. An intelligence layer depends on that operating foundation. The foundation does not depend on any particular intelligence layer. If the foundation is wrong, a second brain organizes the wrong understanding, and acts on it faster.
This is also where the AI operating system idea came from, at least in our work, and the record is dated. The Metaprise™ model, first set out in 1999, drew enterprise applications as a sequential chain, supplier to manufacturer to reseller, and set against it a synchronous architecture coordinating every participant through a shared hub. In the fall of 2004, in a paper titled Acres of Diamonds, I wrote: “It is my position that a true centralization of procurement objectives requires a decentralized architecture that is based on the real-world operating attributes of all transactional stakeholders starting at the local or regional level. In other words, your organization gains control of its spend environment by relinquishing centralized functional control in favor of operational efficiencies on the front lines. This is the cornerstone of agent-based modeling.” In July 2007, I defined it in print as a synchronized rather than sequential architecture linking all transactional stakeholders in real time, with the buyer engaging suppliers, courier companies and customs brokers at once. In December 2007, I wrote that technology designed outside an agent-based model would never reliably establish “the streams of commonality that are driven and defined by real-world processes.” In October 2024, I distinguished technology-led agentic AI from human-led, agent-based models; a week later, I wrote about the birth of the AI operating system, and of agent-based AI operating systems extending to suppliers, couriers and customs. That was almost two years before the term reached the consulting mainstream. The vocabulary changed over 25 years. The architecture did not: the hub, the external stakeholders, the streams of commonality, and the human-led sequence, with technology last.
That is why Phase 0™ matters more in the AI era, not less. A sequential chain contained a misunderstanding at each handoff. A synchronous operating system carries it to every participant at once, so the understanding at its center has to be right before anyone connects to it.
Putting the pattern to the test
Eight incidents are a pattern, not a proof. Before publishing this, we opened a new lab, the Cold Chain Strand Lab, and locked its rules before the search began.
Most analysis publishes what happened. We are publishing, in advance, what would prove us wrong. The results will follow in a separate post.
Truth Is Believing. Accuracy Is Knowing. Outcome Is Proof.™
-30-
References
Share this:
Like this:
Related