On 11 October, someone got into internet-connected refrigeration systems used by French supermarkets and started changing the settings. Reports said the cyberattack affected about 700 supermarkets. When hackers take control of physical equipment, the damage can become frighteningly real, frighteningly fast.
This wasn't the kind of attack most people picture. Nobody went after the tills or customer accounts. They went after the fridges.
We want to be careful here. When the first reports came out, nobody knew who did it or why. So we're not going to call it ransomware, point the finger at a particular group or suggest customer data was taken. Not unless investigators say so.
What we can say is this: someone tampered with connected equipment and caused a real, physical problem inside real shops. That's why it's worth stopping and thinking about.
Carrefour was among the retailers reported to be affected, while coverage also identified Danfoss refrigeration control interfaces as part of the wider incident. Some reports referred to disruption beyond France in other European countries. Those details matter because they show how connected equipment, remote access and third-party technology can create shared cyber risk across multiple sites.
Stores need to keep an eye on temperatures, catch faults early and see how their kit is running. Remote access means engineers can sort things out without driving to every site. That's useful.
But here's the catch. The moment a piece of equipment can be reached over a network, it's part of your technology estate. That includes Internet of Things (IoT) devices and operational technology (OT), such as refrigeration control systems. It needs someone who owns it, controlled access, updates and monitoring. Same as your laptops and servers.
And let's be honest, that often doesn't happen. The kit gets installed for an operational reason and then just quietly gets on with it. IT might not own it. Security might not be watching it. A supplier might be managing it remotely, and nobody inside the business has the full picture of who can get in.
It's a textbook case of an OT & IoT attack, with an immediate knock-on effect:
These are cyber-physical attacks: digital interference that causes physical disruption.
Most businesses have connected kit sitting outside their normal IT world. Heating, cooling, lighting, doors, cameras, sensors, production lines and building-management systems can all form part of an IoT, OT or industrial control systems estate. Some of it was put in by a supplier years ago. Some of it uses remote access for maintenance. Plenty of it works perfectly.
None of that tells you whether it's secure.
So before you even think about buying another security product, ask yourself a few simple questions. Do you know what's connected? Who owns it? Who maintains it? Who can get into it remotely? When was it last updated? Would anyone actually notice if a setting changed?
If those feel hard to answer, that's your starting point.
It's tempting to file connected fridges, boilers or factory equipment under "operations" and leave security out of it. That split doesn't really hold up anymore.
The people who know what happens when the kit goes wrong are usually in facilities, engineering or store operations. The people who understand network access and logins sit in IT and security. And suppliers hold another piece of the puzzle.
They need to talk to each other. IT can't protect equipment it doesn't know exists. Operations can't judge cyber risk without some technical help. And nobody can manage supplier risk if it's unclear who's responsible for access, updates, monitoring and what happens when something goes wrong.
This isn't about dumping everything on the security team. It's about making it obvious who owns what, including third-party technology, supplier access and the systems that support business continuity.
Good doesn't mean unplugging everything. And it doesn't mean wrapping your kit in so much security that nobody can maintain it.
It means knowing what you've got and making sensible calls about it. You can point to your connected equipment, name who's responsible for it and say who can get in. Important systems are kept apart from the rest of the network. Updates have an owner. Unexpected changes get spotted. And there's a practical plan for keeping things running if the kit stops working or can't be trusted.
It's not glamorous. But it's some of the most useful security work a business can do.
This isn't really a story about someone hacking some fridges. It's about how the technology we barely notice can become critical infrastructure for an individual business, supporting safety, stock, the supply chain and day-to-day operations.
Connected kit brings real benefits. But if it matters to safety, customers, revenue or getting through the day, it can't be someone else's problem.
So here's something to ponder. Pick the equipment that would cause you the most trouble if it went wrong. Find out who owns it, who can reach it and what you'd do if it started behaving strangely.
You might find your biggest gap isn't a missing security product at all. It's a connected system nobody remembered was there.
Not sure what's sitting outside your normal IT estate? Start small. Take a focused look at your connected equipment, your remote access and the suppliers you rely on. You're not after another long risk register. You're looking for the handful of gaps most likely to hurt safety or stop you trading, so you can sort those first.