The Cyber Risk Hiding Inside Everyday Physical Systems

Cyberattacks on supermarket refrigerators might seem unusual or minor, but they highlight a much larger issue. Many physical systems are still connected to the public internet, often with old software or weak remote-access controls. The result is a growing attack surface where hackers can disrupt the real world without ever breaching a company’s main network.

[For more news, click here]

This month, hackers breached supermarket refrigeration systems across Europe, raising temperatures and leaving stores to deal with spoiled food, supply disruption, and thousands of euros in losses. This was not a sophisticated attack, but it didn’t need to be.

Attackers did not need to get through layers of corporate firewalls or bring down a retailer’s entire network. They went after refrigeration controls; systems that sit quietly in the background but become critical the moment they stop working properly.

The attacks impacted retailers in Sweden, Belgium, Luxembourg and Ireland after an earlier incident in France, which had already compromised refrigeration at hundreds of supermarkets. Some of the retailers in question have since disconnected their refrigeration systems from the internet and are reviewing their remote access.

A similar attack affected cold-storage systems at three regional blood-service facilities in France. Staff got alerts in time to move blood products to safe refrigerators, but the incident showed how little time there is to react when a cyberattack targets physical infrastructure. Physical systems are being connected faster than they are being secured.

The Attack Surface Is Becoming Too Broad

Industrial and operational technology, or OT, refers to systems that directly control physical processes. This includes things like refrigeration, manufacturing equipment, building controls, water pumps, energy infrastructure, and hospital systems.

For a long time, many people didn’t see these systems as a major security risk because they thought they were protected by being on separate networks.

Security researchers at Claroty examined refrigeration controllers used in supermarkets and cold-storage facilities and found thousands of management interfaces directly accessible from the public internet. In one scan, Censys found 2,765 exposed Danfoss controllers.

Researchers also discovered major security problems in another popular refrigeration platform from Copeland. Claroty found 23 vulnerabilities, with 21 rated as high severity. They showed that a remote attacker could get full access and control physical parts like compressors, cooling fans, and defrost cycles. Claroty

These incidents show the broad scope of cyberattacks. In July, the FBI and US Environmental Protection Agency warned that attackers were targeting internet-facing programmable logic controllers used by water and wastewater utilities. Incidents across at least seven US states caused operational disruptions, including loss of water pressure and flooding.

The FBI found that attackers changed device settings remotely, such as IP addresses and passwords, which left operators unable to see or control their systems as usual. Many victims had similar third-party network setups, which is worrying because a single weak setup can be used in many organizations. FBI

The Pattern Is Bigger Than Refrigeration

The same weakness is showing up across food production, logistics, and healthcare. In July this year, a cyberattack against Nichirei Logistics, Japan’s largest refrigerated logistics operator, disrupted food deliveries across its network. KFC Japan was among the affected businesses, and ingredient shortages created problems at restaurants. The restaurants themselves were not hacked. The logistics provider was.

This difference matters because it shows how fast cyber risks can spread through a physical supply chain. If one operator is compromised, it can disrupt many businesses that never interacted with the attacker. The Record

Food production is also under pressure. Coca-Cola-owned Fairlife temporarily suspended production at its US facilities after a ransomware incident affected operational systems. Product safety was not affected, but manufacturing still had to be interrupted while teams contained and restored systems. The Record

Looking at these incidents together, the pattern is clear. Any connected installation or supply chain can be disrupted. Cybersecurity now affects almost every part of the physical supply chain.

In August, Boston Scientific disclosed that a cyberattack disrupted systems used to process and ship customer orders. The attack did not manipulate a medical device, but it still interfered with the company’s ability to move physical healthcare products to customers. The Record

In October the UNM Health System took it one step further and actually diverted the ambulances and cancelled appointments as a result of the cyber incident. The system includes the state's only Level 1 trauma centre, the children's hospital and the burn unit. The Record

These attacks also show that hackers don’t have to target medical equipment itself. Just disrupting the systems that support patient care can be enough.

The same is true in logistics. A cyberattack on Ceva Logistics resulted in the disruption of operations at a number of European warehouses and the delay of shipments to retailers who had their inventory held at those warehouses. The retailers themselves weren't the primary victims but their operations were still impacted. The Record

This is where the risk gets harder to manage. Even if a company secures its own network, it can still lose the ability to operate if a supplier, warehouse, or contractor in the chain is attacked.

The Middle East Is Not Outside This Risk

In October SESAME (the synchrotron facility in Jordan) was the victim of a major ransomware attack which took out computing, storage and institutional systems. They had to shut down the affected infrastructure safely and then go through a phased recovery of the scientific systems. SESAME

SESAME is not a conventional corporate network. It is deep-tech scientific infrastructure used by researchers across the Middle East.

This makes the incident especially important. As more scientific and industrial systems rely on connected computers, cybersecurity is not just about protecting data anymore. It’s also about making sure physical operations keep running.

Why Are Systems Still Exposed?

Here’s the uncomfortable truth: these vulnerabilities are already known, and most owners or retailers are aware of the problems.

Claroty identified the risks in the refrigeration controllers and worked with the manufacturers to produce patched firmware. They also advised retailers not to connect the management interfaces directly to the internet and to restrict remote access. They made no attempt to take the internet facing controllers offline.

CISA points out that in industrial systems availability is typically the number one priority. Some systems have an availability requirement of 99.999% which makes the simple act of rebooting and patching a whole lot more difficult than it would be in a normal IT environment. CISA

The first problem is keeping systems available. The second is their age. Industrial systems are made to last a long time. Older control systems were designed to run for 20 to 30 years, often before always-on connectivity was common. Most don’t have the security features found in newer systems.

The truth is, the equipment might still work fine for its main job, but from a cybersecurity perspective, it’s outdated.

Patching Is Not Simple

ENISA's 2025 research found that 27% of the organisations surveyed cited the characteristics of their infrastructure as a reason for delays in the application of security updates. This was particularly the case with legacy systems and OT environments which couldn't simply be taken offline without impacting the operation of the business.

Testing and approval steps make patching take even longer. Limited staff, other priorities, and problems working between IT and operations teams can also slow things down. This means it can take a long time to fix a vulnerability after it’s found.

The National Cyber Security Center's annual review warns that aging technology, poor visibility of technology estates, and slow remediation processes will become harder to defend as AI makes vulnerabilities easier to identify and exploit at scale. This is a tough situation. Attackers are getting faster, but physical infrastructure is slow to adapt.

Companies May Not Know What Is Connected

Another issue is one that's less obvious than patching. You often have multiple parties involved in the management of operational infrastructure. A supermarket might own its own refrigeration equipment but have a contractor, an equipment manufacturer or a monitoring company looking after it on a remote basis. The same is true of hospitals, factories and utilities.

Over time, old remote connections can remain active long after their original purpose has changed. Equipment can move between teams, suppliers can change, and systems can remain reachable without anyone realizing that access is still open.

This is how an environment that looks isolated on paper can still have a path to the public internet. The more vendors involved, the harder that becomes to see.

AI Could Make an Old Problem Faster

AI didn't create these weaknesses, it simply exposed them and made them much easier to exploit. Attackers can now use automated tools to search for exposed infrastructure, to understand unfamiliar software and to move through technical documentation at a much faster rate. A vulnerability that previously would have required specialist knowledge is now one that can be found and exploited at scale.

The gap between digital security and operational resilience is closing. A cyberattack doesn't have to involve millions of stolen customer records to be serious. Losing control of systems that keep food cold, manage water pressure, or support patient care can cause just as much disruption. The problem isn't that companies should avoid connecting physical systems. Modern infrastructure relies on these connections.

The real problem is that many of these systems were connected without following the same security processes used for IT systems. Some vulnerabilities are already known, patches might exist, and security advice is often available. Still, these systems stay exposed because replacing old infrastructure costs a lot, downtime is hard to manage, and no one has a full view of every connection.

We already know that many of these systems are exposed. The bigger question is why organizations wait for physical damage before treating them as critical parts of their cyber infrastructure.

Related Articles

Binance Says Hackers Stole $6.3B After Targeting Employees With Fake Job Offer

Automated AI Discovers PHP Vulnerabilities, Forcing Global Web Shut Down

UAE Cybersecurity Council, Veeam Partner on Cyber Resilience