Royal Smilde: ‘The systems were restored, but the emotional impact lingered’
It is every company’s nightmare: falling victim to a cyberattack. Royal Smilde experienced it in 2022. Thorough preparation, available backups and external support helped limit the impact. What the company had not anticipated, however, was the emotional toll. Managing Director Alex Kruiter and ICT Manager Richard Elsinga now address this aspect in the talks they give about the attack.
In the middle of the night on 13 February 2022, ICT Manager Richard Elsinga receives a call from an IT supplier who has spotted suspicious activity on a server. Elsinga contacts several colleagues. Ten minutes later, it is clear that a ransomware attack is underway.
The Cyber Incident Response Plan is activated. Servers are shut down and disconnected, and a crisis team is assembled, including members of the executive team, finance and operations managers, and Elsinga. The team uses a WhatsApp group to share updates and make decisions.
A cybersecurity company is also brought in, with a Computer Emergency Response Team (CERT) available around the clock. “It was a huge help to have an external team we could call on,” says Elsinga. “They knew exactly what needed to be done.” That Sunday morning, Royal Smilde reports the data breach to the Dutch Data Protection Authority and files a police report. “We received immediate help, without having to wait. That was very reassuring,” says Kruiter.
Access through phishing
The hackers turn out to have had access to the systems for around ten days. They obtained an employee’s password through phishing, then created an administrator account and installed ransomware. Because their activity is detected in time and the servers are shut down immediately, only some of the files are affected.
The hackers leave payment instructions in folders containing encrypted files and threaten to publish the stolen data. In consultation with the Supervisory Board, the crisis team decides not to negotiate. The attackers then increase the pressure. They send emails to senior management and use the Works Council’s email account to send threats concerning employees’ personal data and the company’s ability to continue operating. “A dirty game, intended to turn employees against their managers,” says Kruiter. On the Monday after the attack, the company arranges for forty employees to apply for new passports as a precaution.
Meanwhile, the team works on restoring the systems. Royal Smilde has daily backups stored off-site and offline. Together with the cybersecurity company, the team checks which data can safely be restored. The first systems are back online by Sunday afternoon. At one factory, remote recovery is taking too long, so an employee drives there with a hard drive.
Limiting the damage
Early detection, available backups and thorough preparation limit the damage. Royal Smilde has already documented how it should respond to a cyber incident and who should sit on the crisis team. The plan has also been rehearsed. The cybersecurity company and the police support the company through the next steps.
Internal communication receives considerable attention too. “For a while, we gave employees an update twice a day. Not just to keep them informed, but also to keep morale up.” Employees are strongly urged not to respond to messages from the hackers.
The emotional impact of a cyberattack is much harder to prepare for. “I realised quite early on that the attack could have much wider consequences for the company,” says Kruiter. “If we paid, it would mean we would be unable to invest in the business for the next few years. That would leave us at a competitive disadvantage we could never recover from.”
Flowers for the families
Ultimately, the company’s operations are halted for around a day, but the aftermath lasts much longer. “We asked a great deal of the team, particularly the ICT department.” The families at home are not forgotten either. The partners of the employees involved receive flowers as a thank-you. “Our employees worked very long hours and were hardly home,” says Kruiter. “Their partners knew something was going on, but not how serious the situation was.” Elsinga adds: “I barely had time to bring my wife and children up to speed, for example.”
Royal Smilde’s relatively successful recovery is no coincidence. The company is technically well prepared, backups are available, and the teams involved are used to working under pressure. Crisis situations are familiar in the food industry, whether a product recall or a problem with a supplier. “And those things usually happen on a Friday afternoon,” says Kruiter.
After the attack, Royal Smilde tightens security further. Employees are required to change their passwords, and the planned introduction of two-factor authentication is brought forward. Stricter requirements are imposed on suppliers and other external parties. External access to the systems now requires multi-factor or two-factor authentication.
Keeping the conversation going
Cybersecurity remains on the agenda. In the first few years after the attack, Royal Smilde uses tools including a game to keep employees aware of the risks. Topics include recognising suspicious links and handling passwords carefully. Maintaining that awareness remains a challenge in an organisation with around 1,000 employees. The company therefore sends simulated phishing emails to identify which approaches employees are susceptible to. If someone clicks a link, this prompts a conversation and further guidance. The aim is to raise awareness, rather than penalise anyone.
The attack stays with those involved for a long time. For quite a while, Elsinga remains braced for another weekend phone call. Over Christmas, when operations are shut down, internet access to the systems is disabled. Even so, eliminating every risk is impossible. “You cannot prevent everything. There is no such thing as 100 per cent certainty,” says Kruiter.
That makes preparation essential, Elsinga stresses. Cybersecurity does not directly generate more revenue or improve products, so it can easily slip down the list of priorities. Given the potential damage of an attack, he believes it is irresponsible to wait until something goes wrong before taking action.
Kruiter and Elsinga have regularly shared their experiences with other organisations and businesses. On 12 November, they will do so again during a masterclass for fellow IFFI members, during the IFFI Masterclass | Advancing Operations in Food.
Published in EVMI magazine, no. 6, 2026.
Alex Kruiter and Richard Elsinga
