On 17 April 2025, attackers got into Marks & Spencer. Its chairman, Archie Norman, later told a parliamentary committee that the way in was social engineering, in other words impersonation, and that a third party was involved.1 On 25 April, M&S stopped taking clothing and home orders through its website and app. Online clothing orders only restarted on 10 June, 46 days later.5
The cases below share that shape: the attack started, or spread, through a company the victim trusted. Here is what the companies and the authorities said about each, and the questions they leave for every provider that can log in on your behalf.
The help desk
Norman gave the committee few technical details. “They just didn’t walk up and say will you change my password,” Norman said. “They appeared as somebody with their details.” A third party was also involved: “part of the point of entry also involved a third-party”.1 According to BleepingComputer, the attackers impersonated one of the 50,000 people who work with the company, and the outside firm that provides help desk support for M&S is believed to have been tricked into resetting an employee’s password.1 Norman did not name the third party, and we do not name it either.
When online clothing orders came back on 10 June, click and collect, next-day delivery and international orders were still due to follow in the coming weeks.5
The remote management tool
On 2 and 3 July 2021, Coop Sweden had to close about 800 stores because it could not operate its cash registers.23 Attackers had pushed ransomware to customers of a US company’s remote management software, disguised as an update.3 One of Coop’s software suppliers, a Swedish firm that used that technology to manage servers and devices for businesses, confirmed it had been affected.23
The FBI has documented the same route in food and agriculture. In July 2021, ransomware deployed through software used by an IT support provider halted production, shipping and receiving at a US bakery company, which was shut for about a week.6 At farm co-operatives hit by ransomware, the ways in included “secondary infections from the exploitation of shared network resources or compromise of managed services”. When a business management software company was hit that same July, the attack led to “secondary ransomware infections on a number of its clients, which included several agricultural cooperatives”.4
CISA and its partners explain why this route attracts criminals. Remote monitoring and management software has “significant capabilities to monitor or operate devices and systems”, and remote access software has become “a common, high-value instrument for cyber threat actors, especially ransomware groups”. Small and mid-sized businesses rely on IT providers and their remote tools, which makes them “that much more vulnerable to service provider supply chain compromises”.7
The software host and the service provider
In November 2024, a ransomware attack on the hosted environment of Blue Yonder, a supply chain software company with more than 3,000 customers, disrupted its clients.8 Morrisons, the British supermarket chain, told the trade magazine The Grocer that its fresh and produce warehouse management systems were disrupted.8 With the system shut down, the retailer had no visibility of its fresh produce stock. Its chief executive, Rami Baitieh, said: “We found a workaround very quickly, but our availability fell significantly, and we very sadly let down some customers.”9
On 2 November 2026, store refrigeration in at least nine European countries was taken over remotely, AFP reported, and the early accounts point the same way.10 One Swedish chain said all its affected stores were connected to an external refrigeration control system, without confirming a cyber attack.10 In Portugal, the group behind seven affected stores said the attack appeared to have targeted an external service provider.11 These accounts were checked on 3 November 2026, the day after the attacks, and may change. We cover the French attack and the wave that followed in a separate article.
The logistics partner
Sometimes the provider is the one hit, and its customers feel it at once. In April 2021, ransomware hit Bakker Logistiek, a Dutch company that delivers cheese and other products to supermarkets. “We could not accept orders and we did not know where in our warehouses particular products were,” said its director, Toon Verhoeven. “Nor could we plan deliveries because we have hundreds of lorries and that cannot be done by hand.”12 For days, less food reached the supermarkets, and cheese shelves emptied.13
On 14 May 2025, a ransomware attack hit Peter Green Chilled, a UK logistics company for chilled food whose customers are mostly smaller producers supplying regional supermarkets in Somerset.1415 It processed no new orders the next day, while its lorries kept running: “The transport activities of the business have continued unaffected throughout this incident,” said its managing director, Tom Binks.15 Wilfred Emmanuel‑Jones, founder of The Black Farmer and a customer, said “something like ten pallets worth of meat products” risked being thrown away if they could not reach retailers in time.15
What to ask every provider that can log in
In Spain, the rules already put one outside firm inside many plants. Under the refrigeration safety regulation (RSIF), Level 2 installations, which include ammonia plants and systems that cool controlled-atmosphere rooms, must have a maintenance contract with an authorised refrigeration company. Where leak alarms are used, they must also alert an authorised person.16
For food manufacturers, processors and wholesalers of medium size and above, the EU’s NIS2 directive lists supply chain security among the measures it requires, “including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers”.17 Spain has not yet passed its NIS2 law: in July 2026 the European Commission referred Spain to the EU Court of Justice over the delay.18
CISA and its partners advise customers of IT providers to understand which security services their contract covers, and to make it say how and when the provider will tell them about an incident. They should also see logs of the provider’s presence, activity and connections on their networks, and make sure its accounts are monitored and audited.7 Turned into questions for your IT provider, your refrigeration contractor and your line integrator alike:
- Who can reset our passwords, and how do you check that a request really comes from us?
- Who can push software or updates to our computers and machines?
- Who can reach our plant and cold-room controls from outside, from where, and through what?
- Which accounts do you use with us? Do they have multi-factor authentication, and is any admin password shared with your other customers?7
- How quickly will you tell us if you are hit, and does our contract say so?7