A reported cyberattack affecting refrigeration systems at supermarkets in several European countries has drawn attention to a growing business risk: attacks on connected operational technology can move beyond data theft and directly disrupt day-to-day operations.

According to the report, attackers remotely changed temperature settings on freezers and cooling systems used by multiple supermarket chains. While the full technical details and attribution were not confirmed in the source, the incident points to the exposure created when physical systems such as refrigeration, building controls and industrial devices are remotely managed through networked platforms.

What happened

The reported incident involved hackers interfering with supermarket refrigeration systems across multiple European markets. By changing temperature settings remotely, the attackers reportedly disrupted normal store operations and potentially affected cold-chain reliability for chilled and frozen goods.

Based on the source report, the disruption appears to have affected operational systems rather than only office IT. That distinction matters because operational technology incidents can create immediate commercial consequences, including product spoilage, safety checks, store disruption and emergency maintenance costs.

Why it matters for European businesses

For European businesses, this is a reminder that cybersecurity is not limited to laptops, email and cloud software. Many organisations now rely on internet-connected devices and third-party platforms to run essential physical operations, including refrigeration, HVAC, access control, warehousing, manufacturing and energy management.

When these systems are exposed or poorly segmented, a cyber incident can lead to:

• interruption of business operations
• damage to stock or temperature-sensitive goods
• health, safety or compliance concerns
• service outages across multiple locations
• higher recovery and maintenance costs
• reputational damage if customers are affected

The incident is especially relevant in Europe because multi-site retailers, logistics businesses, food companies and other operators increasingly manage equipment centrally across borders. A compromise in one management layer, supplier connection or remote access channel can potentially affect many sites at once.

It also reinforces the importance of cyber resilience in sectors covered by stricter security expectations, including businesses reviewing obligations under frameworks such as NIS2. Not every company affected by similar risks will fall directly under NIS2, but the direction of travel in Europe is clear: critical and digitally dependent operations are expected to take cybersecurity governance more seriously.

Who may be affected

The most directly affected organisations are retailers and food businesses using network-connected cooling infrastructure, but the broader lesson applies across sectors.

• Supermarkets and food retailers: refrigeration failures can affect product quality, waste levels and store operations.
• E-commerce grocery and fulfilment operators: temperature-controlled storage is critical for inventory and delivery chains.
• Hospitality and food service businesses: restaurants, hotels and catering operations often depend on centrally managed cooling systems.
• Warehousing and logistics providers: cold-chain facilities and distribution hubs may face similar exposure.
• IT and facilities teams: responsibility often spans both cybersecurity and building systems, creating shared operational risk.
• Companies using third-party building management providers: vendor access and remote administration may become a key attack path.

What companies should consider

Businesses that rely on connected physical infrastructure should review whether operational systems are being treated as core cyber assets rather than isolated facilities tools.

• Map connected operational technology: identify refrigeration, HVAC, energy, access and other building systems that can be remotely accessed or centrally managed.
• Review remote access paths: check vendor accounts, admin portals, VPNs and any internet-exposed management interfaces.
• Segment operational systems from office IT: reducing unnecessary connectivity can limit the spread and impact of an attack.
• Apply strong authentication: use multi-factor authentication where supported and remove unused accounts.
• Clarify vendor responsibilities: confirm who monitors, patches and secures the systems, and how incidents are escalated.
• Monitor for configuration changes: alerts for unusual temperature changes or remote setting updates can help detect tampering earlier.
• Test business continuity plans: make sure store, warehouse or site teams know how to respond if automated systems are disrupted.
• Include facilities technology in cyber risk reviews: many businesses still assess SaaS and endpoints more thoroughly than operational equipment.

For SMEs, the key lesson is practical: if a digital system can control a physical process, it belongs in cybersecurity planning. Businesses do not need to be large enterprises to face operational disruption from insecure connected equipment, especially when systems are managed by external providers or shared platforms.