When cyber attacks get physical: key lessons for retailers

What happens when a cyber-attack doesn't take down your website or lock employees out of their laptops, but instead turns up the temperature of your fridges or changes your air conditioning settings?

Recent cyber-attacks targeting supermarket refrigeration systems across Europe expose a growing blind spot for retailers and offer a reminder that cyber risk doesn't stop at the IT network. As stores, warehouses and supply chains become increasingly connected, operational technology (OT) and Internet of Things (IoT) devices are creating new routes through which hackers can cause significant business disruption.

For UK retailers, the lesson extends well beyond fridges. The incidents are an opportunity to reassess how OT and IoT risks are identified, governed, and managed across complex store estates and supply chains, particularly where equipment is maintained or remotely accessed by third-party suppliers. ‍

Has operational technology been overlooked when it comes to cybersecurity?

Historically operational technology has been something of a cybersecurity blind-spot, with incidents like the French fridge hack the latest example. OT systems were traditionally designed with longevity and reliability in mind, not security. Often complete separation from corporate networks meant concern about hacking was minimal, especially with cybersecurity teams focused on data loss as the biggest security risk. As connectivity has increased, particularly to help with analytics on the efficiency of operational technology systems and remote management, that isolation has ended. Security investment hasn't generally kept pace though. In some ways that's a surprise as one of the earliest warnings of the risks around OT was the attack on Target in the US in 2013, when attackers gained entry to Target's network through credentials stolen from an air conditioning contractor, compromising around 40 million payment card records). In that case the attack vector was an insecure third-party connection to an operational system. Many retailers still make the same structural mistakes as Target, failing to treat OT and IoT systems as a primary attack surfaces requiring appropriate cybersecurity standards. ‍

Does the fact that the French fridge hackers do not appear to be pursuing a ransom make attacks like this more unpredictable or dangerous?

The lack of a ransom demand should give retailers cause for concern. Conventional ransomware attacks, whilst deeply disruptive, follow a broadly predictable playbook: system encryption followed by financial demand. When there is no ransom demand, the attacker's objective becomes harder to determine, and that uncertainty is itself a threat. Motivations could range from nation-state disruption, ideological activism, competitive sabotage, or stress-testing systems ahead of a larger attack. Each demands a fundamentally different response. Without knowledge of motivation security teams are to some extent working in the dark. There is also a concerning escalation risk. An attacker willing to destroy stock without looking for a ransom payment may be willing to compromise food safety systems, supply chain integrity, or other logistics at a much larger scale. The French incident resulted in tonnes of spoiled food, which was costly but ultimately recoverable. A sustained, coordinated attack on infrastructure across multiple retailers simultaneously could have serious public health implications going well beyond financial loss.

Are supermarkets sufficiently protected against operational technology attacks?

The evidence suggests not. The French incident isn't isolated. It reflects a systemic gap in how many retail sector operators approach OT security. Legacy OT systems that were never designed with cyber resilience in mind are frequently still in use, running without basic security controls such as authentication, encryption, or the capacity to receive software patches. With ever growing pressures on retail sector margins, running legacy systems to end of life can be a simple way of avoiding significant capital expenditure on new infrastructure, but it's a gamble. While most retailers have invested in securing e-commerce platforms and payment systems, OT environments connected to refrigeration, energy management, and logistics have received less attention. The UK's Cyber Security and Resilience Bill, which will broaden obligations for operators of critical national infrastructure and 'designated critical suppliers', which may include supermarkets and key players in their supply chains. The combination of regulatory compulsion and greater board-level commitment to cybersecurity in OT after recent attacks should start to change the picture.

What should retailers be doing to strengthen their security?

The starting point should be visibility. Many retailers lack a complete inventory of connected devices operating across their estates (whether that's refrigeration units, thermostats, smart shelving, or energy management systems), which makes meaningful risk assessment and management near impossible. Once an inventory is in place network segmentation is vital, with OT systems isolated from corporate IT networks, with strictly controlled and monitored access points for third-party vendors. The Target breach is a textbook example of what happens when that boundary is poorly managed: a single compromised air-con credential cascaded into one of the largest retail data breaches ever. Regular penetration testing should be part of a strengthened security stance, and staff awareness training should move beyond phishing emails to include the risks posed by physical and operational systems. Finally, many retailers' incident response plans need updating to account for OT-specific failure scenarios, including food safety and supply chain continuity.

What does the future threat landscape look like, and could AI exacerbate these risks?

The threat landscape is becoming considerably more challenging. As use of connected technology expands - automated warehouses, smart energy systems, IoT-enabled supply chains - the attack surface grows. Each new connected device is a potential entry point, and pace of deployment typically outstrips pace of security assessment. Artificial intelligence introduces a meaningful escalation on both sides. For retailers, it offers genuine capability improvements in anomaly detection, threat intelligence, and rapid incident response, which is particularly valuable in OT environments where unusual behaviour may otherwise go unnoticed for extended periods. However, hackers are equally well-positioned to exploit AI. It lowers the barrier to entry for sophisticated attacks, allows faster information gathering on complex OT environments, and can automate attacks at a scale and speed that human defenders can't match. The combination of ageing infrastructure, expanding connectivity, and AI-augmented adversaries is a convergence of risks that the retail sector needs to address with urgency and strategic investment, rather than reactive patching.

As retailers continue to invest in connected stores, automation and smart infrastructure, building security into OT and IoT should form part of that transformation from the outset. Taking a joined-up approach to cyber security, technology governance, supplier management and incident response will help retailers innovate with confidence while protecting operational resilience.

Get in touch

Whether you are reviewing connected assets, third-party access, contractual protections or incident response arrangements, our team can help you understand your risks, regulatory obligations, and contract weak spots, and identify practical steps to strengthen resilience. Get in touch to discuss your approach.