Thought Leadership
The attacks on supermarkets have exposed serious weaknesses in operational technology (OT). Here’s why operators urgently need to focus on genuine cyber resilience.
A wave of attacks targeting commercial refrigeration systems is emerging as one of the year’s most significant OT security incidents.
Germany has not been spared. In early November, several supermarkets in North Rhine-Westphalia, Lower Saxony and Bavaria fell victim to cyberattacks targeting their refrigeration systems. Multiple well-known retail chains, including Edeka and CAP, were affected. Their cooling systems were manipulated remotely, with some switched from cooling to heating mode. The consequences were severe: large quantities of spoiled food had to be discarded. The incidents in Germany are part of a broader series of cyberattacks across several European countries.
As early as the night of October 11–12, 2026, an unknown attacker gained access to the refrigeration controls of hundreds of French supermarkets and switched them to defrost mode overnight. Several major retail chains were affected, with up to 700 stores impacted. Temperatures in some units climbed above 50°C, and several caught fire. Total damages ran into tens of millions of euros.
About two weeks later, the Pentagon announced that it was treating similar refrigeration failures at military bases as suspected cyberattacks. On November 2, the same pattern emerged again at supermarkets in at least six European countries.
This is precisely the kind of scenario security experts have been warning about for years: a large-scale cyberattack on critical infrastructure with real-world physical consequences. Supermarkets may not traditionally be considered critical infrastructure, but food supply is among the sectors covered by the EU’s NIS2 Directive.
The incidents also offer several practical lessons for anyone operating internet-connected OT systems.
1. The Swiss Cheese Problem of Remote OT Access
Despite the scale of the incidents, they were not the result of extraordinary attacker ingenuity. Instead, they highlight the devastating potential of poorly secured OT management interfaces exposed to the internet.
Months before the reported waves of attacks, Claroty’s Team82 investigated the AK-SM 800A, a system manager made by Danish manufacturer Danfoss that controls a store’s refrigeration display cases. The security research team uncovered a series of textbook vulnerabilities. Using internet scanning platforms, researchers identified 2,765 management interfaces directly accessible from the internet.
The controllers shipped with a hidden “Code-of-the-Day” authentication mechanism: a backdoor code derived from the device’s date that could be used instead of the administrator password. Anyone able to reconstruct the algorithm could therefore log in. Once authenticated, an attacker could exploit a separate command injection vulnerability to execute arbitrary operating system commands, achieving full remote code execution and taking control of the device.
This resembles the Swiss cheese model used in workplace safety. Incidents occur when weaknesses across multiple layers of protection line up, creating an uninterrupted path for an attack. In this case, those weaknesses included an internet-facing interface, an authentication mechanism with a built-in bypass, and a command injection vulnerability. The most important safety layer was missing altogether: there was no independent high-temperature shutdown to prevent a controller from overheating the room, nor was there a defrost function that would have triggered an alarm in time.
These incidents demonstrate that there is no such thing as “security through obscurity.” Simply hoping that nobody will bother hacking a refrigerator is not a security strategy. If an attack succeeds, network segmentation, strong authentication and removing systems from direct internet exposure form the first line of defense.
2. “Anyone Could Be Behind It” Says a Lot About OT Security in 2026
But who are the attackers? No nation-state actor or hacktivist group has claimed responsibility, and no ransom demand has emerged. This has fueled speculation that the incidents could be linked to ransomware, particularly following the 2025 attacks on British retailers Marks & Spencer and Co-op. Others suspect a lone attacker. Ken Munro of Pen Test Partners even suggested that it could be “kids messing around.”
The fact that such a wide range of theories is plausible says a lot about the current state of OT security. A decade ago, a major OT attack affecting a dozen companies and causing physical damage would almost certainly have been attributed to a military power or state-sponsored group. Several developments have since expanded the pool of potential attackers. Access has become easier because so many interfaces are reachable through publicly accessible IP addresses. At the same time, the barrier to entry has fallen. Internet scanning platforms such as Shodan and Censys allow virtually anyone to identify exposed controllers, while inexpensive tools increasingly supported by large language models (LLMs) can turn scan results into working exploits.
Attacks have also become more opportunistic. The vulnerability increasingly determines the target, rather than the other way around. The attackers were probably not specifically targeting food retailers in Germany, France and Estonia. Instead, they likely identified a category of exposed, exploitable devices and attacked anything that responded. The same mechanism has been observed in recent broad-based campaigns targeting programmable logic controllers (PLCs), where victim selection appears to follow exposure rather than specific targeting.
3. Patching Only Goes So Far
The final and perhaps most troubling aspect is that the vulnerabilities were already known to Danfoss. The manufacturer had addressed them in a 2025 firmware update, yet the attacks still succeeded.
Anyone who has ever managed an OT patching program can probably guess why. Some of the affected companies likely had no reliable way of knowing whether they were using these controllers at all, let alone which firmware versions were installed. Maintaining an inventory of OT assets is difficult enough within an organization. It becomes even harder when devices have been installed and are managed by an external vendor.
Even companies that know they urgently need to install patches face significant challenges. Rolling out firmware updates across hundreds of locations means dealing with limited on-site personnel, downtime and potential product losses. Some hardware cannot be updated at all. Two of the three affected models, the AK-SM 800 and AK-SC 355, had already been discontinued and no longer received security patches. In such cases, the only option is to implement compensating controls, isolate the device or configure remote access so that it never comes into contact with the internet.
The incidents also challenge the assumption that newer devices are inherently more secure. The third affected model, the AK-SM 800A, is still current and supported. However, the affected devices were running outdated firmware, a situation that these attacks show is far from unusual.
In short, authentication and patching are important lines of defense, but they should not overshadow four equally critical aspects of OT security: secure-by-design principles, accurate OT asset inventories, automated vulnerability detection, and proper change and configuration management.
These measures matter because the current combination of factors is dangerous. Attack tools are cheap and fast. Asset discovery and patching are not. OT defenses are also still largely designed to keep attackers out, with little consideration given to what an authenticated user can do once inside or whether baseline configurations remain intact. The lessons are clear: close security gaps, monitor for obvious anomalies, assume that an attacker will eventually manage to authenticate, and restrict what can be changed during that session.
More broadly, organizations across all industries need to focus increasingly on what may be the most important aspect of all: cyber resilience.Even with strong security controls in place, companies must prepare for the possibility that an attacker will get through. Relying solely on keeping attackers out is no longer enough.In refrigeration, this means independent temperature limits and alarms, the ability to isolate compromised controllers without interrupting local cooling, and a tested process for restoring normal operations.
The specific components may differ across industries, but the underlying principle remains the same: contain the damage, standardize response plans, maintain critical operations and recover quickly when defenses fail.
