A cyberattack that turns supermarket freezers off might sound like an unusual headline.
But the implications go well beyond spoiled food.
Recent cyber incidents have disrupted supermarket refrigeration systems across several European countries. Attackers reportedly accessed connected equipment and changed temperature settings, leaving retailers facing spoiled stock, operational disruption and difficult questions about the security of the technology they rely on.
It's a striking example of how a cyberattack can affect the physical world. And it raises an important question for every business: do you know which technologies are connected to your network, and how well they are protected?
Cybersecurity is no longer just about laptops, email accounts and servers. From refrigeration and building management systems to networked machinery, CCTV and access controls, businesses increasingly depend on connected equipment to keep their operations running.
If that equipment is overlooked during security reviews, it could create an opportunity for attackers.
Reports in October and November 2026 described suspected cyberattacks affecting supermarket refrigeration systems across Europe.
In the latest incidents, reported on 2 November, retailers in several countries experienced problems after refrigeration controls were allegedly accessed and temperature settings changed. Some stores were forced to remove or discard chilled and frozen stock as a precaution.
The incidents followed a similar attack in France in October, where supermarket refrigeration systems were also reportedly manipulated remotely. While investigations are ongoing and the full technical details have not been made public, reporting has highlighted familiar security concerns. These include internet-connected industrial systems, outdated software and manufacturer-default passwords that had not been changed.
The important point is that these incidents did not require attackers to compromise supermarket tills or steal customers' payment details to cause disruption. By targeting equipment responsible for maintaining safe storage temperatures, the impact could be felt directly in day-to-day operations.
It is a reminder that the consequences of a cyberattack are not always limited to data loss.
Many organisations now rely on technology that sits outside what they might traditionally consider their IT network.
Examples include:
These technologies can bring genuine benefits. They can improve efficiency, provide remote visibility and help businesses manage complex operations.
But connectivity also introduces security considerations.
A device may have been installed by a specialist supplier, managed by a third party or introduced years ago without the involvement of the organisation's IT team. It may not appear on the asset register, receive regular updates or be monitored in the same way as company laptops and servers.
That creates a visibility problem. If a business doesn't know a device exists, it is much harder to understand the risks it introduces or ensure it is properly protected.
The supermarket incidents are a timely reminder of the importance of securing connected technology. They also sit within a wider cyber threat landscape that the National Cyber Security Centre (NCSC) has been examining in its newly published Annual Review 2026.
The review looks back at the NCSC's tenth year, covering developments between September 2025 and August 2026. It highlights how technology is changing the way cyber threats evolve, while reinforcing a familiar message: many successful attacks still exploit weaknesses organisations already know how to address.
The NCSC's incident management team received 1,831 reports of cyberattacks affecting organisations over the year. Of these, 337 incidents required support from the team, with 80 classed as nationally significant.
Its analysis of those incidents highlights seven important lessons. Among the most relevant for businesses are:
The review also highlights the growing impact of artificial intelligence. The NCSC assesses that AI is likely to increase the speed, scale and efficiency of cyber operations, supporting activities such as reconnaissance, social engineering, vulnerability discovery and exploit development.
This matters because organisations may have less time to identify and address weaknesses before attackers attempt to exploit them.
The message is not that every business should be worried about a futuristic AI-powered attack. It is that the time available to respond to familiar vulnerabilities may be shrinking.
For businesses with ageing technology, limited visibility of connected devices or slow update processes, that presents a real challenge.
You can read the full NCSC Annual Review 2026 for further detail.
The exact security measures will depend on the type of equipment, how it is used and the potential impact if it becomes unavailable. However, there are several practical steps organisations can take to reduce avoidable risks.
You cannot properly protect technology you don't know exists.
Start by building an accurate inventory of devices and systems connected to your business network. This should include more than computers, laptops and servers.
Consider specialist equipment, cameras, access control systems, printers, and building management technology and devices that are managed by external suppliers.
For each device, establish who owns it, who is responsible for maintaining it, whether it needs internet access and how it is managed.
This visibility makes it easier to identify devices that may have been overlooked and understand where additional security measures are needed.
Updates are not just about new features or performance improvements. They frequently address security vulnerabilities that could otherwise leave devices exposed.
Where manufacturers provide security updates, businesses should understand how these are applied, who is responsible and how quickly critical fixes can be deployed.
This can be more complicated with specialist or operational technology, where updates may need to be tested or coordinated to avoid disrupting business operations.
If a device is no longer supported by its manufacturer, it may be time to consider whether to replace it or isolate it from other systems.
Remote access can make it easier for suppliers and technical teams to monitor and maintain equipment. However, it needs to be properly controlled.
Default passwords should always be changed, and accounts should use strong, unique credentials. Where supported, multi-factor authentication (MFA) should be enabled to provide an additional layer of protection.
Businesses should also review who has remote access, remove accounts that are no longer required and avoid exposing management interfaces directly to the public internet.
If a supplier needs access to a system, agree how that access is provided, monitored and withdrawn when it is no longer necessary.
Not every connected device needs access to every other part of a business network.
Network segmentation helps separate devices and systems according to their purpose and risk. For example, specialist operational equipment could be isolated from the network used by employees, reducing the opportunity for an attacker to move between systems if one device is compromised.
Monitoring is equally important. Businesses should understand what normal activity looks like and have a way to identify unusual connections, unexpected access or suspicious behaviour.
Segmentation and monitoring should be designed around the equipment and the operational consequences of disruption, rather than applied as a one-size-fits-all solution.
The supermarket freezer incidents are an unusual example, but the underlying lesson applies to organisations of every size and across every sector.
A business's technology estate is often much broader than its employees' computers and the systems managed by its IT department. Connected equipment can support everything from day-to-day operations to physical security and business continuity.
The NCSC's Annual Review 2026 reinforces the need for organisations to take a joined-up approach. Attackers continue to exploit familiar weaknesses, while developments in AI are increasing the pace at which threats can evolve.
That makes visibility, vulnerability management, secure access and proactive monitoring increasingly important.
At Netitude, we believe effective cybersecurity starts with understanding the technology a business relies on, identifying where risks exist and taking practical steps to manage them. That means looking beyond the obvious devices and considering how the wider technology environment is connected, maintained and protected.
When was the last time your organisation reviewed everything connected to its network?
If you're unsure whether your current security measures cover the technology your business depends on, speak to the Netitude team. We can help you understand your IT environment, identify potential gaps and consider the steps needed to strengthen your cyber resilience.