A cyberattack forces you to pull the plug. Can your business keep running?

The recent cyberattack on European supermarkets sent the temperature in some Swedish freezers to a sweltering 131 F (55 C). The Dutch grocery chain Ahold Delhaize warned that a separate hack could strip up to 250 million euros ($277 million) from sales, and wipe as much as 100 million euros off operating profit in the fourth quarter. 

This recent spate of cyberattacks around the world, including a staggering $6.3 billion heist at the crypto exchange Binance, lays bare a blind spot in many boardrooms. Directors too often ask whether attackers can break into their systems. They should also be asking whether the business can take the hit and keep running.

Boards should assume attackers will get through. It’s a question of when, not if. And when they do, can the business still fulfill orders, pay staff, and keep critical facilities open? 

Too rare

Unfortunately, this is often not the case in the companies that I deal with. I recently worked with a board that had rightly grown more worried about cyber threats, and drafted in a former spy to carry out a cyber audit. The contractor ran penetration tests, hacked a few of the firm’s products, and found holes in its defenses. 

That’s fairly typical. The audit tested whether hackers could penetrate the company’s defenses. But it stopped short of testing whether the business could ride out a breach. And this is the gap I see running through many companies. 

Sometimes, stopping an attack from spreading means shutting down the very systems that keep you operating. 

Ahold Delhaize took some of its own websites and apps down as a precaution after the cyberattack, cutting off online shopping for some customers. The Dutch group contained most of the disruption within two weeks and it was getting back to normal once it reported third-quarter results. In Belgium, it had online shopping back up and running just a week after disclosing the breach. 

Contrast that with Marks & Spencer, the British retail stalwart. After a breach in April 2025, it stopped taking online clothing orders for a spell of 46 days. And when orders finally resumed, only part of its clothing range was available.

If you have to pull the plug on your own systems to contain a breach, how will you keep serving customers? 

The AI factor

AI is only raising the stakes. It’s my view that cyber threats have changed more in the past six months than in the previous six years. But many companies haven’t caught up.

Some of the newest crop of AI models are spotting security flaws that their predecessors missed, and have worked out how to exploit some of them. 

Take Anthropic’s Mythos Preview, which scored about 83% on a cybersecurity benchmark, compared with roughly 67% for the company’s previous best model, Claude Opus 4.6. Anthropic says it spotted thousands of security flaws, many of them serious, including in every major operating system and web browser. Worrying indeed. 

Last week, OpenAI released GPT‑6 Cyber to vetted customers. The model is designed to find security flaws and test whether they can be exploited.

The U.K.’s National Cyber Security Centre says the gap between a flaw becoming public and attackers exploiting it has already shrunk to just days. And it predicts that AI will compress that window further still, giving defenders even less time to patch the holes.

The most recent spate of supermarket hacks came on the heels of a similar hack of fridges at hundreds of French supermarkets. The result was piles of spoiled food, and fires even broke out.

Following that breach, Danfoss, the Danish industrial company that made the temperature controls, urged its customers to update their software and hardware. But just weeks later, hackers hit retailers using Danfoss controls again. This time, stores in several European countries were hit, including Sweden and Ireland.

Some fared better than others. Carrefour said it had installed updates and secured its connections after the first wave of attacks, steps it credited with curbing the numbers of its Belgian stores hit. Acting on the first warning helped Carrefour blunt the next attack.

Some retailers left their refrigeration systems exposed. That’s unacceptable. But even with tighter security, you still need a way to trade when the systems you depend on go dark.

What to do

Protect the operations you can least afford to lose. Then drill your teams on how to keep them running through an attack. When the malware designated NotPetya hit Maersk in 2017, the shipping giant handled about 80% of its usual volume manually. Staff taped paperwork to containers and took orders through personal Gmail accounts.

Consider a distribution center that needs to keep essential goods moving. Ask one team to fulfill a handful of priority orders without its usual order system or company email. Can staff confirm orders using a secure offline list and an agreed backup channel, check stock by hand and arrange transport? Have them log each dispatch on paper and check those logs against the order system once it’s back online.

When the drill ends, ask how much of the usual workload the team handled safely, for how long, and where it got stuck. Give each fix an owner and a deadline, then run the drill again.

Find out how long you can keep serving customers with your systems down. A real attack is a brutal way to get the answer.