If it stopped tonight

• Butchers and small shops were hit, not just big chains. Attackers went looking for equipment left open on the internet. Size had nothing to do with it.
• Spend 30 minutes listing what you can’t trade without, how long you’d last without each one, and who you’d call.
• Put it on one printed page, and keep a copy somewhere other than the office computers.
• Backups you have tried restoring matter more than any spare machine.

• 2 November

  More than 100 shops in one night

  Fridges and freezers in supermarkets and butchers were switched to defrost or heated up remotely. Shops in Belgium, Luxembourg, Sweden, Estonia, Finland, Ireland, the Netherlands, Portugal and Italy threw out spoilt food. One Belgian butcher’s fridges reached 18°C, and about €15,000 of meat was lost. Hundreds of French supermarkets were hit the same way in October.

• the way in

  An open door, not a clever hack

  The fridge controllers could be reached from the internet so that contractors could check them from afar. The maker said some of the Dutch systems still had their factory passwords, and many units were older models that no longer get security updates.

• who

  Nobody knows yet

  No group has claimed it. Belgian prosecutors have opened a criminal case. Belgium’s cyber centre says the culprit may never be found.

The lesson for Singapore isn’t about fridges. Cold rooms, CCTV, aircon, door locks, tills and booking systems are often looked after by a contractor through the internet. If they can reach it, others might too.

Sit down with whoever runs the place day to day. For each of these four, write how long you’d last without it, and who you’d call first.

• money in

  Till, payment terminal, online orders, invoicing. Could you take payment some other way tomorrow morning?

• stock

  Cold room, warehouse, stock list. How many hours before you start throwing things away?

• people paid

  Payroll, CPF, supplier payments. Who can log in to the bank if the usual computer is locked?

• customers

  Email, WhatsApp, the customer list. How would you tell them what’s going on, and from where?

• 1 · contractors

  What do they reach from outside?

  ask

  Can this be reached from the open internet? Has the factory password been changed? Does it still get updates?

  why

  Those three answers were the whole story in Europe.

• 2 · backups

  When did you last restore one?

  ask

  Is there a copy that is offline, or that can’t be changed or deleted? Has anyone tried bringing a file back from it?

  why

  Ransomware locks the copies it can reach. A backup nobody has tested is a hope, not a plan.

• 3 · passwords

  Who holds the keys?

  ask

  Who has the admin passwords for email, the bank, the website and the accounting system? What if that person is away or has left?

  why

  Many small firms find out mid-crisis that only a former staff member or an old vendor can log in.

• 4 · paper

  What would you need on paper?

  ask

  Staff phone numbers, key customers and suppliers, the bank’s fraud line, your IT contractor, your insurer.

  why

  If the computers are locked, the contact list on them is locked too.

• 5 · insurance

  What does your policy cover?

  ask

  Does it cover spoilt stock, lost trading days or a cyber incident? What does the insurer need you to do, and how fast?

  why

  France’s cyber agency told shops to check their insurance terms before cutting a contractor’s connection. Some policies ask for steps in a set order.

• Who decides. One name, and one backup name.
• Who calls whom. Staff, IT contractor, bank, insurer, key customers.
• The first hour. Unplug the affected machines from the network and leave them switched on. Don’t pay anyone. Don’t wipe anything until someone has looked.
• How you keep trading. Manual receipts, a phone for payments, where the offline copies are.
• Who to report to. SingCERT for cyber incidents. PDPC if personal data may have leaked: once you decide a breach must be reported, you have three calendar days.

Print it. Keep one copy at the shop and one at home.

The PDPA covers personal data: names, NRIC numbers, phone numbers, salaries. Tender prices and company accounts usually aren’t personal data, so they are a security matter, not a PDPA one. People who handle both need some of each. PDPC’s own competency levels for data protection staff ↗ are a fair guide to how deep each person should go.

• everyone

  Anyone with a company login

  Spots a fake email or invoice and reports it the same day. Uses two-step login and a password manager. Locks the screen. Shares files through company links, not personal email or WhatsApp. Knows which AI tools are allowed and what stays out of them.

• sensitive files

  Tenders, finance, payroll, HR

  All of the above, plus: sets who can open each file and removes people when they leave. Sends tenders only through the buyer’s portal. Never changes a supplier’s bank details because an email said so, and calls back on a known number first. Removes NRICs and salaries before forwarding anything.

• your DPO

  The person named for data protection

  Every organisation must name one, and it can be the owner. Keeps a list of what personal data you hold, checks vendors, decides whether a breach must be reported, and trains the others. A common course for this role is the Practitioner Certificate in Personal Data Protection. Find a class on MySkillsFuture ↗

• the owner

  Four answers, no jargon

  What data do we hold? Who can see it? What would we do if it leaked or got locked? Who is our DPO?

A quick way to check: ask each person to show you how they’d share a tender file, what they’d do with an email giving new bank details, where they’d report a suspicious email, and how they’d remove a leaver’s access. If they can do all four, that matters more than a certificate.

If the office runs on Windows, a Mac on standby sounds like a neat plan B. It helps a little, if you set it up right.

• helps

  Most office ransomware is built for Windows and spreads through shared Windows logins. A Mac kept outside all that will probably still start up.

• doesn’t help

  If it syncs the same shared folders, it downloads the locked files too. If attackers have the email password, they have it on every machine. Some ransomware gangs make Mac versions as well.

• set it up so

  It has its own login and admin password. It isn’t syncing the shared folders all the time. It gets updated every month. Someone switches it on and tries it every quarter. It holds the one-page plan and the contact list, and can reach the bank with its own two-step login device.

A spare laptop of any kind, Windows or Mac, is worth having to keep invoicing and paying staff. It doesn’t replace a backup you have tested. Do the backup first.

1. Pick a morning. Say out loud: “The main computer is locked and there’s a ransom note on the screen.”
2. Without touching the computer, find the one page, call the first name on it, and take one sale or one payment the backup way.
3. Write down what was missing. Fix one thing this week.

• a checklist

  CSA’s Cyber Essentials ↗ mark is a short set of basic measures sized for small firms. Even if you never apply for the mark, its list is a good place to start.

• someone to look

  Under CSA’s CISO-as-a-Service ↗ scheme, a listed consultant checks your setup and writes a plan. Eligible SMEs can get co-funding; check CSA’s page for the current terms.

• reporting

  SingCERT ↗ for cyber incidents, and PDPC ↗ for a data breach.

• Store counts and country lists differ between reports, and some chains only said “IT incident”. Treat the numbers as early.
• How the attackers got in is still being worked out. Default passwords and old software are what the maker and France’s cyber agency pointed to, not a final finding.
• No Singapore shops have been reported hit. The point is the kind of weakness, which is common everywhere.

Sources: CNA ↗ (with AFP), Al Jazeera ↗, The Hacker News ↗, and France’s CERT-FR alert ↗ (in French, last updated 16 Oct 2026).

Written 4 Nov 2026. My own view. I’m not a security specialist or a lawyer, and I shaped this page with Claude. Not affiliated with or endorsed by CNA, AFP, CSA or PDPC.