UNFI
$350–$400million
Estimated impact on fiscal 2025 net sales from the cyber incident.
LOGISTICS, DISTRIBUTION & MANUFACTURING
Keep the work moving.
The camera, gate reader, scanner, and refrigeration controller are part of your operation. Know what they can reach before a security problem stops the shift.
REPORTED DISRUPTIONS
How disruption reaches the business.
Marks & Spencer
46days
Online clothing and home orders paused; clothing orders began returning after 46 days.
Jaguar Land Rover
~5weeks
UK production paused, followed by a phased manufacturing restart from October 8, 2025.
These cases show the operational consequences of cyber incidents. None is known to have started with a camera.
AN ILLUSTRATIVE SCENARIO FROM BOOK TWO
2:17 a.m.
Forty trucks arrive at six.
A loading-yard camera starts talking to an unfamiliar internet address. It shares a network with the gate readers, dock doors, and systems that tell the trucks where to go.
The question for the person on call: can you contain that camera without stopping the operation?
This is an illustrative scenario from the book, not a reported customer incident. Read the opening.
SEVEN DOORS INTO THE OPERATION
Start with the access you can explain.
- 01
Factory passwords
Know the devices and replace shared or default logins.
- 02
Old software
Prioritize exposed devices; plan vendor updates and downtime.
- 03
One flat network
Separate operational devices from the systems that run orders and shipping.
- 04
Permanent vendor access
Identify remote sessions and approve the access each vendor needs.
- 05
Exposed control panels
Find management interfaces reachable from the wrong networks.
- 06
Unwatched radio links
Include RFID, wireless scanners, and cellular connections in the review.
- 07
A fix nobody checked
Check that the exposure closed and that the affected service still works.
Security has to account for the service.
Shipping and receiving
Gate readers, scanners, RFID, and dock controls support the movement of goods.
Production
Controllers and vendor connections need named owners, agreed access, and a safe change plan.
Cold chain
Closing an attack path is not enough. Temperature monitoring, alarms, and cooling must still work.
FROM A WAREHOUSE ASSESSMENT
A warehouse device nobody was watching.
A vendor-supplied device running part of a warehouse had a SIM card slot, a remote-access tool nobody managed, and camera passwords anyone on the network could read. Two of the most serious issues could be fixed with one small setting.
Observed in a NetOps IQ assessment. Customer and device maker unnamed.
See the full summaryCONTROLLED DEMONSTRATION
RFID and heating-and-cooling controls.
Book Two describes a NetOps IQ demonstration on an operator’s equipment: a test attack on RFID infrastructure was detected and stopped, followed by a second test attack on the building’s heating-and-cooling controls. These were demonstrations, not live incidents.
Read the scope of the demonstrationStart with one site.
Findavi Operational Blind Spot Assessment
A scoped, on-site assessment of connected devices, exposed paths, accountable owners, and supported response options.
One warehouse, distribution center, camera fleet, RF environment, or cold-storage zone.
The assessment only listens. Taking action is part of a full Findavi deployment, and only happens under rules you approve. Choose Observe, Approve or Autonomous for each device. Findavi's AI runs on the appliance itself. No outside AI. The network data it collects never leaves your site.