The Camembert Didn't Melt on Its Own

Sunday 11 October, in the small hours. In a supermarket on the outskirts of Paris, the fridges start to warm up. Nobody has broken in. Nobody has touched a thing.

Six hours later they read 50 degrees. In Normandy, another supermarket hits 80. The sprinklers go off and equipment melts.

At that temperature, Camembert doesn’t ripen: it melts. Frozen croissants end up in the bin before they ever see an oven. In the country that turned food into heritage, tonnes of cheese, butter and pastries end up in the skip.

This isn’t a breakdown. It’s hundreds of supermarkets across half a dozen chains, all at the same time.

Out on the streets, France watches more than 1,500 shops being looted. Online, nobody needed to smash a single window at these supermarkets: it was enough to switch on the automatic defrost remotely, exploiting a flaw known since 2023. No ransom, no data theft. A week later, nobody has claimed responsibility.

And before anyone thinks it: no, this isn’t some Spanish tomato getting its revenge.

Everything that matters is wired up now

Food, water, electricity and fuel all run today through connected systems that hardly anyone sees. A fridge controller, a pump at a water treatment plant or a sluice gate on a dam can be one click away from anyone with bad intentions.

Office IT and factory IT used to live apart. Not any more.

Spain is already on the list

• Hacktivists. The pro-Russian group NoName057(16) has been knocking over the websites of Spanish ministries, town councils and companies since 2022. The Guardia Civil arrested three collaborators in 2024. In March 2026, an alleged collaborator was picked up in Palencia, working for the groups that have tampered with the control panels of water plants in the United States and Europe.

• Cybercriminals. In 2021, ransomware brought Damm’s biggest brewery to a standstill. In 2025 it halted production at Hero in Murcia. In March this year it forced the Port of Vigo to disconnect and go back to paper.

• Petrol stations. In February 2018, ASPERTIC reported that 189 Spanish petrol stations had their tank valves reachable from the internet. Only one had a password. The case reached the Senate, and the Government replied that “there is no possibility of the tanks being manipulated remotely”. By then, a petrol station in Seville had already given away free fuel to anyone who happened to pass by.

So far, in Spain, the goal has been money or noise. What happened in France is a different league altogether.

When the attack leaves the screen

In June 2022, a group called Predatory Sparrow, which has been linked to Israel, released CCTV footage from an Iranian steelworks. It shows a machine spilling molten steel and a fire breaking out.

▶ Video: Footage released by Predatory Sparrow of the attack on the Khuzestan Steel plant (2022)

It wasn’t a one-off. The same group knocked out most of Iran’s petrol stations in 2021 and in 2023. In 2025 it destroyed around 90 million dollars at a cryptocurrency exchange.

Europe has been through it too. In Norway, pro-Russian hackers opened the floodgates of a dam and 7.2 million litres poured out in four hours. In Poland, in December 2025, destructive malware hit more than 30 wind and solar farms.

The next blackout may be different

After the blackout of 28 April 2025, half of Spain took it for granted that it had been a cyberattack. It wasn’t: that was ruled out by the CCN (the National Cryptologic Centre), the Joint Cyberspace Command and the National High Court judge who closed the case.

But taking comfort from that is a mistake. An attack doesn’t need to switch off a whole country. It’s enough for it to be surgical: a few fridges here, a sluice gate there, a port the following week. Each blow is small. Together they erode trust in everything we take for granted, and that is usually the point.

NIS2: this means you too

The European NIS2 directive raises the cybersecurity bar for essential and important entities: energy, transport, water, health, food, manufacturing, chemicals and digital services.

Plenty of people think it doesn’t affect them because they’re not an electricity company. Wrong. The rules require those companies to keep their suppliers in check. If you work for one of them, the requirements will reach you through contracts, questionnaires and audits.

And one more detail: Spain still hasn’t transposed it, two years after the deadline. Brussels has already taken us to the Court of Justice of the EU. The law isn’t in the BOE, Spain’s Official Gazette, yet, but attackers don’t wait for the BOE.

Over to you

Do you think Spain is ready for something like this? Let me know in the comments.

---

Originally published on LinkedIn on 19 October 2026.