When Refrigeration Systems Become Cyber Targets: A Wake-Up Call for OT Security

The recent cyberattacks on refrigeration systems across Europe demonstrate that even relatively simple manipulations of operational technology (OT) can cause substantial economic damage and potentially threaten patient safety. More importantly, they expose a fundamental weakness in enterprise cybersecurity: connected operational systems are often essential to business continuity yet remain outside established security governance.

The incidents also raise a broader question: Are organizations sufficiently prepared for cyberattacks that target physical processes rather than data or IT systems?

What Happened?

In October and early November 2026, cyberattacks targeted refrigeration systems across hundreds of European supermarkets, including locations in France, Belgium, Sweden, Ireland, and the Netherlands.

Attackers accessed refrigeration controllers and manipulated operating parameters, including temperature settings and defrost cycles. Some temperature setpoints were reportedly raised to 50°C or higher. The consequences included spoiled food, operational disruptions, and substantial financial losses.

Similar attacks affected three cold-storage facilities operated by the French Blood Establishment (EFS). In this case, monitoring and alarm systems detected abnormal conditions before any damage occurred to blood products and plasma.

The incidents demonstrate how the manipulation of relatively simple control systems can have consequences extending far beyond the affected equipment. The precise attack paths and possible connections between individual incidents remain under investigation.

For technical context, the French CERT-FR advisory documents the compromise of refrigeration management controllers and recommends eliminating public internet exposure.

Why Are Refrigeration Systems Connected to the Internet?

There are legitimate operational and economic reasons to connect commercial refrigeration systems.

Supermarket chains operate large numbers of refrigeration units across geographically dispersed locations. Centralized monitoring enables operators and maintenance providers to control temperatures, detect technical problems, optimize energy consumption, and perform maintenance without dispatching technicians to every location.

In hospitals, laboratories, and pharmaceutical settings, remote monitoring also supports continuous temperature monitoring, documentation, and regulatory compliance.

The problem is not that refrigeration systems are connected. It is how they are connected and who has access to them.

Some installations expose management interfaces directly to the public internet, often to enable convenient remote access for external service providers. This exposure can result from legacy configurations, insufficient security requirements, or inadequate coordination between equipment suppliers and corporate IT.

Secure remote maintenance does not require publicly accessible management interfaces. Nevertheless, convenience and operational efficiency have often taken precedence over cybersecurity.

Practical examples of controlled remote connectivity are included in NIST’s implementation guide for OT remote access.

Why Were These Systems Not Better Protected?

The incidents reveal several structural weaknesses that characterize OT security across many organizations.

• Unclear cybersecurity ownership. Refrigeration systems are typically managed by facility management departments or by external maintenance providers. Corporate cybersecurity teams may have limited visibility into installed equipment, its software, and its network connections.
• Long equipment lifecycles. Operational equipment often remains in service for 10 to 20 years or longer. Software support, authentication mechanisms, and security updates may not keep pace with evolving threats. Equipment replacement is expensive and often driven more by technical reliability than by cybersecurity.
• Inadequately secured remote access. Maintenance providers often need access to customer installations. Shared credentials, weak authentication, insufficient network segmentation, and poorly protected interfaces can turn legitimate maintenance access into attack vectors.
• Underestimated operational consequences. A refrigeration controller may seem less critical than an ERP system or a hospital information system, yet its compromise can destroy valuable products, disrupt operations, or threaten patient safety.

These weaknesses reflect a persistent disconnect between IT security practices and the management of physical operational environments.

What Needs to Happen Now?

Organizations operating refrigeration infrastructure should immediately review their exposure and operational safeguards.

   1. Identify and secure exposed systems. Establish an inventory of connected controllers, software versions, and remote access configurations. Eliminate unnecessary internet exposure and implement strongly authenticated, restricted remote access.

   2. Review third-party dependencies. Clarify which suppliers and maintenance contractors can access operational equipment, under what conditions, and with what permissions. Ensure access can be monitored and revoked.
   3. Strengthen operational safeguards. Independent temperature monitoring, reliable alarms, and predefined intervention procedures should prevent unauthorized controller changes from automatically causing product losses or operational disruptions.
   4. Prepare for recovery. Operators need procedures to isolate compromised equipment, restore trusted configurations, validate product safety, and maintain critical operations.

These measures address the immediate refrigeration risk, but they do not resolve the broader problem.

What Does This Mean for OT Security More Generally?

The refrigeration attacks are not primarily a refrigeration problem. They expose vulnerabilities that span a much wider range of operational environments, from manufacturing and logistics to healthcare, utilities, and commercial buildings.

OT security has traditionally focused on industrial control systems, production machinery, and critical infrastructure. These environments remain important, but they constitute only part of the operational attack surface.

Modern enterprises also rely on building automation, HVAC systems, access controls, elevators, laboratory equipment, environmental monitoring, energy management, and many other connected devices. These systems are often operated by different departments, supported by specialized vendors, and managed outside established IT security processes.

Their individual technical complexity may be limited, but their collective operational importance can be significant.

NIST’s Guide to Operational Technology Security explicitly includes building automation, physical access control, and environmental monitoring systems in its scope.

PAC sees several areas where organizations need to rethink their approach.

1. OT Security Must Follow Business Dependencies, Not Organizational Boundaries

The traditional separation among IT, OT, facility management, and specialized operational systems creates significant security gaps.

A manufacturing company may have a mature OT security program protecting production lines, while the connected infrastructure supporting those lines receives less attention. Cooling systems, compressed air installations, environmental controls, or power distribution equipment can become single points of failure.

The same applies to hospitals, where laboratory equipment, medical refrigeration, building automation, and technical infrastructure contribute directly or indirectly to patient care.

Security priorities should be determined by the consequences of compromise, not by the department that owns the equipment.

This requires a broader assessment of operational dependencies. Organizations need to understand not only which devices are connected but also which business processes depend on them and what happens when those devices are compromised or become unavailable.

A relatively inexpensive controller may warrant substantial protection if its failure can interrupt a high-value production process.

2. Third-Party Access Is One of the Central OT Security Challenges

Operational environments rely heavily on external equipment manufacturers, maintenance contractors, system integrators, and specialized service providers.

These relationships introduce access paths that are often difficult for the customer to monitor and control. A service provider may require connections to hundreds of customer installations, potentially creating a common attack path across otherwise unrelated organizations.

The challenge therefore extends beyond securing individual devices. Organizations must manage the entire remote maintenance ecosystem.

This means replacing permanent, broadly privileged access with controlled, authenticated, and preferably time-limited access. Access rights should be limited to the equipment and functions required for a specific task, with appropriate logging and monitoring.

Equally important, suppliers must demonstrate how they secure their remote management infrastructure, credentials, and maintenance processes.

For enterprises, supplier cybersecurity is no longer just a procurement or compliance matter. It is a direct operational dependency.

3. OT Security Monitoring Must Understand Physical Processes

Conventional cybersecurity monitoring is primarily designed to detect suspicious network traffic, unauthorized access, malware, and other technical indicators of compromise.

These capabilities remain necessary, but they do not provide a complete picture of operational risk.

An attacker who successfully authenticates to a control system may use legitimate administrative functions to manipulate equipment. From a purely technical perspective, these activities can resemble normal operations.

The security question is therefore not only whether a command was authorized but also whether the resulting behavior makes sense in the operational context.

Unexpected temperature changes, unusual pressure variations, unauthorized changes to control parameters, or equipment operating outside expected parameters can indicate manipulation, even when conventional security alerts remain inconclusive.

Effective OT security increasingly requires integrating cybersecurity telemetry with operational data and process knowledge.

This does not mean integrating every sensor into a central SOC. It means identifying relevant operational indicators, setting meaningful thresholds, and defining who is responsible for responding when abnormal conditions occur.

The objective must shift from detecting unauthorized access alone to recognizing when cyber activity threatens the integrity of a physical process.

4. Cyber Resilience Must Be Built Into Operational Processes

Many cybersecurity strategies focus primarily on preventing intrusions and restoring IT systems after an incident.

In OT environments, this approach is insufficient. Restoring a controller does not reverse spoiled food, damaged materials, interrupted production, or compromised medical products.

Organizations therefore need to design their operational processes so that a successful cyberattack does not automatically cause physical damage or prolonged disruption.

Independent monitoring, safety mechanisms, restricted operating parameters, manual intervention capabilities, and alternative operating procedures can significantly mitigate the consequences of compromised control systems.

The refrigeration incidents illustrate this distinction. When independent alarms and intervention procedures functioned effectively, dangerous controller settings did not necessarily result in product losses.

This principle applies equally across manufacturing, logistics, energy infrastructure, and healthcare.

Operational resilience must address not only how quickly systems can be restored but also how essential processes can remain safe and functional during an attack.

5. Legacy Equipment Requires a Different Security Strategy

OT environments cannot simply adopt conventional IT patching and replacement practices.

Many operational systems have long lifecycles, limited maintenance windows, proprietary software, and dependencies that complicate upgrades. In some cases, manufacturers no longer provide security updates.

Organizations therefore need practical strategies for equipment that cannot meet current cybersecurity standards.

Network isolation, secure access gateways, continuous monitoring, and additional protective controls may reduce exposure without replacing otherwise functional equipment. However, these measures cannot indefinitely compensate for fundamentally insecure products.

Security requirements should therefore influence procurement decisions, maintenance contracts, lifecycle planning, and replacement budgets.

The economic argument is important: postponing a relatively modest security investment may seem attractive until a compromised device disrupts an operation whose financial value far exceeds the cost of the equipment.

6. AI Is Compressing the Vulnerability-to-Patching Cycle

AI-assisted vulnerability discovery, exploit development, and automated reconnaissance are shortening the window between identifying a weakness and exploiting it. Meanwhile, the growing volume of disclosed vulnerabilities is putting additional pressure on security teams to distinguish urgent threats from background noise.

This imbalance is especially problematic in OT environments. While attackers can act within hours, deploying a patch may require vendor approval, compatibility testing, maintenance windows, and careful consideration of operational safety.

The traditional approach to assessing and addressing vulnerabilities during scheduled maintenance is increasingly difficult to sustain. Yet a blanket “patch now, think later” strategy can be equally dangerous. Untested updates may disrupt production or compromise the reliability of critical equipment.

Organizations therefore need to distinguish between patching and reducing exposure. Actively exploited vulnerabilities and internet-facing systems require immediate attention. When patches cannot be deployed safely, network isolation, restricted remote access, additional monitoring, and other compensating controls can reduce risk until tested updates are available.

AI can also help defenders prioritize vulnerabilities by correlating exploit activity with asset criticality and operational dependencies. However, automated recommendations must be validated against operational requirements.

The challenge is no longer simply to patch faster. It is to reduce exploitable exposure before attackers can exploit it, without jeopardizing operational continuity.

7. OT Security Needs Stronger Integration With Enterprise Risk Management

The refrigeration attacks also demonstrate that OT security should not remain an isolated technical discipline.

Business continuity, operational risk, supplier management, cybersecurity, and facility management are closely interconnected, yet organizations often assess them in isolation.

A more mature approach integrates these perspectives. It links technical vulnerabilities to specific operational scenarios, including production interruptions, inventory destruction, service outages, environmental damage, or threats to human safety.

This allows management to prioritize investments based on potential business impact rather than on vulnerability counts or technical classifications alone.

It also shifts the conversation with business executives. Instead of explaining why a particular industrial controller needs additional protection, security teams can demonstrate which revenue streams, operational capabilities, or safety requirements rely on it.

What Does This Mean for Cybersecurity Service Providers?

The growing relevance of connected operational equipment creates opportunities for security providers but also raises the requirements for their capabilities.

Traditional vulnerability assessments, network security, and SOC services remain relevant. However, effective OT security requires a deeper understanding of physical processes, equipment lifecycles, engineering constraints, and supplier relationships.

Service providers need to expand their portfolios to include operational asset discovery, secure third-party access, process-aware monitoring, and resilience assessments that link cybersecurity risks to operational consequences.

There is also a growing need for closer collaboration among cybersecurity specialists, industrial engineering experts, facility management providers, and equipment manufacturers.

Providers that combine these capabilities will be better positioned to support customers in environments where the distinction among IT, OT, and connected facilities is increasingly artificial.

The commercial opportunity is not merely to connect more OT devices to existing security platforms. It also helps customers identify and protect operational dependencies that have historically been overlooked.

PAC’s Assessment

The refrigeration incidents demonstrate that relatively simple cyberattacks can cause significant physical and financial consequences when operational equipment is inadequately secured.

They also challenge the traditional distinction between critical and non-critical infrastructure. A small controller may seem insignificant from an IT perspective, yet its compromise can disrupt an essential business process or endanger human safety.

For enterprises, the priority is to extend cybersecurity governance, monitoring, and resilience planning across the entire operational environment, including systems traditionally managed outside IT.

For service providers, this requires moving beyond a technology-centric approach to OT security and building capabilities to address operational dependencies and business impact.

The fundamental lesson is that OT security can no longer be assessed solely by the technical importance of individual devices. It must reflect the business and safety consequences of their compromise.

Related PAC Research

• Expert View: Continuous Exposure Management Brings Business Impact View to IT Security Monitoring – Exposure prioritization based on business criticality and attack paths.
• Cybersecurity Services Provider Landscape in Germany – InBrief Analysis – OT-specific capabilities and specialist service provider requirements.
• Accenture’s OT Security Bet: A Very Expensive Deal That Makes Strategic Sense – The expanding scope of OT security and the implications for enterprise resilience.