Binance Hack: How Social Engineering Opened...
A fake recruitment process, malicious software and compromised devices were all used in the recent Binance security incident. This article...
Read More
Most organisations associate cyberattacks with stolen data, encrypted servers, compromised email accounts or unavailable websites. Recent attacks against supermarket refrigeration systems across Europe demonstrate a very different type of cyber risk.
Attackers have remotely manipulated internet-connected refrigeration controllers, changing temperature settings and activating defrost functions. Refrigerators and freezers have heated up, food has been destroyed, stores have had to intervene manually and earlier incidents in France reportedly resulted in equipment fires.
The attacks provide a striking example of operational technology, or OT, cyber security, where digital systems interact directly with physical equipment and processes.
For leadership teams, the lesson extends far beyond supermarkets. Similar technology controls manufacturing machinery, heating and ventilation, building-management systems, warehouse equipment, utilities, medical devices, access systems and other physical infrastructure. When these systems are compromised, the consequences can move beyond the digital environment very quickly.
A major wave of attacks in October affected hundreds of French supermarkets. Attackers remotely accessed refrigeration controllers and altered their settings, including triggering defrost cycles and reportedly setting target temperatures as high as 50°C.
Retailers were forced to discard stock where safe storage temperatures could no longer be guaranteed, with Reuters reporting potential losses running into tens of millions of euros. Some incidents reportedly resulted in refrigeration equipment overheating or catching fire.
A second wave followed at the beginning of November, affecting more than 100 stores and other businesses across several European countries, including Belgium, Luxembourg, Sweden, Ireland, the Netherlands and Estonia. Large retailers and independent businesses were affected, while an IKEA location was also among those reporting refrigeration problems.
UK businesses have not been completely untouched. Three British meat suppliers were reportedly targeted through vulnerable refrigeration controllers, although the impact was limited and no meat was lost. The NCSC said it had been assisting affected organisations and proactively contacting businesses where vulnerable systems appeared to be exposed to the internet.
No group has publicly claimed responsibility for the European attacks, and authorities have not established whether all of the incidents were carried out by the same attackers.
The concern has also extended beyond Europe. On 5 November, US authorities warned of an ongoing cyber threat to industrial refrigeration following attacks on commercial systems and suspected attacks affecting refrigeration at US military facilities. American agencies urged operators to remove controllers from the public internet, isolate them from corporate networks and apply available security updates.
Operational technology describes systems used to monitor or control physical equipment and processes.
Traditional IT security is often discussed in terms of confidentiality, integrity and availability. Those principles still matter in an OT environment, but the consequences of losing integrity or availability can be considerably more serious.
If an attacker compromises a customer database, the organisation faces a confidentiality problem. If an attacker compromises a refrigeration controller, they may be able to alter the temperature. If they reach industrial machinery or a building-management system, they may be able to interfere directly with physical operations.
The NCSC warns that OT environments can present significantly greater consequences than standard IT systems, potentially including physical damage and risks to human safety. These environments also frequently rely on obsolete or legacy technology that lacks modern security capabilities.
A cyber incident involving equipment that keeps food, pharmaceuticals, chemicals or blood products at safe temperatures can therefore become an operational, financial, regulatory and potentially safety-critical event at the same time.
Many operational systems are connected because there are genuine business benefits. Engineers can monitor multiple sites remotely, equipment faults can generate automatic alerts and suppliers can diagnose problems without visiting the location.
The difficulty is that connectivity also creates an attack path.
Security researchers examining the recent refrigeration attacks identified controller interfaces accessible directly from the public internet. Some affected systems were reportedly running older or unsupported technology, while researchers also observed attempts using publicly documented default credentials.
The NCSC has repeatedly warned organisations not to assume operational technology is isolated simply because nobody intentionally exposed it. Legacy connections, misconfiguration, unmanaged assets and forgotten remote-access arrangements can all create internet-facing systems without leadership necessarily realising they exist.
This makes asset visibility fundamental. An organisation cannot effectively protect an industrial controller if nobody knows it exists, why it is connected, who manages it or whether it can be reached externally.
This can be particularly challenging where specialist contractors install and maintain equipment. Facilities may consider it operational equipment, the supplier may see it as part of a maintenance contract and IT may have little involvement. From an attacker’s perspective, however, it is still an internet-connected system capable of controlling something valuable.
Industrial equipment is often expected to remain operational for much longer than ordinary IT devices. A corporate laptop might be replaced every four or five years, while a refrigeration controller, manufacturing system or building-management device may remain in service for 10, 15 or even 20 years.
Physically, it may still work perfectly. From a cyber security perspective, that can create problems.
Manufacturers may stop providing security updates. Modern authentication such as MFA may not be supported. Operating systems can become obsolete, while replacing the equipment may require wider changes or lengthy periods of downtime.
The NCSC recommends that externally connected devices remain within vendor support, are kept updated and are replaced before reaching end of life where possible. Where obsolete equipment cannot immediately be replaced, compensating controls may include segmentation, hardened intermediary systems, restricted connectivity and enhanced monitoring.
This distinction matters for senior management. A system can be operating exactly as intended while still presenting an unacceptable security risk.
One of the most important defences in an OT environment is separation.
A refrigeration controller does not normally need unrestricted communication with the wider corporate network or public internet. Where remote access is genuinely necessary, it should be controlled, authenticated, monitored and limited to the systems and people that require it.
The NCSC recommends segmenting management systems, operational technology and business IT so that compromise of one environment does not automatically provide access to another. It also recommends unique administrative accounts, replacing default credentials, stronger authentication where supported and detailed monitoring of communications involving OT assets.
This becomes particularly important where suppliers require remote access. External maintenance may be operationally necessary, but permanent or poorly controlled supplier connectivity can create an enduring attack route.
Organisations should understand how vendors connect, whether access remains enabled continuously, how suppliers authenticate, whether activity is logged and what happens when equipment or maintenance contracts change.
Patch management in an OT environment is rarely as simple as updating an ordinary workstation.
A software update may need extensive testing to ensure it does not interfere with a production process. Equipment may only be capable of being taken offline during a scheduled maintenance window, a supplier may need to approve the update, and some older systems may no longer have updates available.
These constraints are real, but they do not remove the vulnerability.
Following the first wave of refrigeration attacks, equipment suppliers and security specialists urged organisations to update affected systems and remove vulnerable controllers from direct internet exposure. During the subsequent wave, some businesses were still operating exposed systems.
Where immediate remediation is impossible, organisations need to understand and actively manage the residual risk. This may mean disconnecting the system from the internet, restricting access through a secure gateway, increasing monitoring, isolating equipment or accelerating replacement.
A workaround can reduce the likelihood of compromise, but it should not become a permanent substitute for addressing the underlying problem.
The financial consequences of the refrigeration attacks demonstrate why OT security belongs in business continuity planning.
In the French incidents, hundreds of supermarkets were affected and significant quantities of food had to be destroyed. The physical equipment could still exist and stores could remain open, yet one compromised control system was enough to make valuable stock unusable.
Recovery therefore involves more than restoring technology. Stock may need to be checked and discarded, replacement goods sourced, equipment inspected before returning to service and temporary capacity arranged.
There may also be consequences for customers, suppliers, regulatory requirements and insurance.
Reuters reported that some insurers considered spoiled food resulting from the French incidents potentially outside standard cyber insurance coverage because many policies focus on digital losses rather than physical inventory. Coverage will depend on individual policy wording and circumstances, but the issue highlights a potential gap between traditional cyber risk and physical operational loss.
Boards should therefore avoid assuming that cyber insurance has transferred the entire risk. Where cyber compromise can damage physical assets or stock, insurance arrangements need to reflect that possibility.
One of the biggest governance challenges is deciding who owns operational technology security.
IT may manage the network, cyber security may manage vulnerabilities, facilities may manage refrigeration or building systems, engineering teams may manage industrial equipment and procurement may own supplier contracts. External contractors may also maintain the equipment.
If responsibilities are not clearly defined, vulnerabilities can remain unresolved because everyone assumes somebody else owns them.
Leadership teams should have assurance that the organisation maintains an accurate view of its OT environment, including internet-facing systems, remote connections, obsolete equipment, critical suppliers and available security updates.
The NCSC also recommends maintaining tested backups of controller configurations and critical engineering data so affected systems can be restored safely following an incident.
OT security should therefore form part of normal cyber security and business continuity governance rather than being treated purely as an engineering responsibility.
The supermarket refrigeration attacks may initially sound unusual. Hackers attacking freezers is certainly less familiar than ransomware encrypting corporate servers, but that is precisely why the incidents matter.
Modern organisations increasingly connect physical infrastructure to digital networks. Heating, air conditioning, refrigeration, manufacturing equipment, security systems, vehicles, medical technology and warehouse automation can all depend on software and remote connectivity.
Every connection creates operational benefits, but it can also create an attack path.
The recent incidents demonstrate what can happen when attackers discover that seemingly routine technology can influence a valuable physical process. The most visible damage may not be an encrypted file or stolen database. It may be spoiled stock, damaged equipment, disrupted operations or physical danger.
For leadership teams, the lesson is straightforward: cyber security should not stop at the boundary of the IT department. If technology can influence the physical operation of the business, it belongs in the organisation’s cyber risk assessment too.
AJC can help organisations review the cyber security and resilience of operational technology environments, including internet-facing systems, remote access, supplier connections, asset visibility and business continuity arrangements.
Our team can support organisations with cyber security reviews, risk assessments, vulnerability management and scenario-based exercises to help identify gaps and strengthen resilience across both IT and operational environments.
Contact AJC on 020 7101 4861 or email info@ajollyconsulting.co.uk to discuss how we can help assess and strengthen your organisation’s OT security and wider cyber resilience.
Sources:
https://www.ncsc.gov.uk/collection/operational-technology/secure-connectivity
https://therecord.media/british-businesses-caught-in-europe-wide-supermarket-fridge-attacks
Image accreditation: Chuttersnap (May 2021) from Unsplash.com. Last accessed on 9 November 2026. Available at: https://unsplash.com/photos/white-and-blue-labeled-pack-on-shelf-6xB6mxsLTV0
A fake recruitment process, malicious software and compromised devices were all used in the recent Binance security incident. This article...
Read More
The European Commission’s investigation into Booking.com highlights how fraud can exploit trust within digital platforms. This article looks at the...
Read More
When a fraud incident crosses an organisation’s escalation threshold, the first hour can be critical. This article looks at how...
Read More