A series of suspected and confirmed cyberattacks targeting supermarket refrigeration systems has disrupted retailers across Europe, exposing vulnerabilities in internet-connected industrial control equipment.
The incidents highlight how vulnerabilities in connected control systems can disrupt physical operations, even when the immediate target is not a company’s core IT network. The consequences extend beyond data loss to equipment disruption, food spoilage and potential interruptions to supply chains. The incidents underline the need for engineers and operations teams to consider cybersecurity when designing, connecting and maintaining industrial equipment.
Escalating Cyberattacks on Industrial Operations
On 2 November 2026, refrigeration systems at dozens of Delhaize stores in Belgium and Luxembourg malfunctioned. Carrefour Belgium also reported problems at around 15 of its stores. Sabcobel, which manages refrigeration systems for Delhaize, said the units’ evaporators had been switched into defrost mode, causing temperatures to rise. Some affected retailers reported having to discard food.
Similar refrigeration problems were reported in several other European countries, including Sweden, Estonia, Ireland, the Netherlands and Finland. Some Swedish retailers reported freezer temperatures reaching 50°C, prompting the removal or disposal of affected chilled and frozen products. Sabcobel chief executive Stephan Moelans said the affected Belgian systems had been switched to defrost mode, causing temperatures to rise.
The incidents followed a cyberattack reported overnight on 11–12 October 2026, when refrigeration systems at hundreds of French supermarket locations were disrupted. Affected retailers included Intermarché, Carrefour and other chains. Attackers reportedly manipulated defrost settings, causing some refrigeration areas to reach unusually high temperatures. Reports described temperatures of about 50°C in some locations and up to 80°C in individual cases. The incident caused food losses and, in some stores, equipment damage.
Reports linked the incidents to refrigeration controllers running older Danfoss software. Some affected systems were reportedly accessible remotely, but the precise method of access has not been established publicly. French authorities opened an investigation into the October incident. The attacks demonstrate how compromised refrigeration controls can disrupt food retail, although the claim that this was the first cyberattack to have a real-world effect on a national food supply chain requires independent evidence.
Manufacturing Sector: A Primary Cyber Battlefield
Beyond retail, the manufacturing sector itself has become a primary target for cybercriminals. Cyber incidents reported in February 2024 illustrate how attacks on corporate IT systems can disrupt industrial businesses. UK-based electronics manufacturer Volex reported a cyber incident affecting its IT systems and engaged external specialists to investigate.
German automotive supplier ZF Friedrichshafen also reported a cyber incident. Specify the affected sites and any production disruption using the company’s original statement or a reliable contemporary report. The company isolated affected systems and engaged external cybersecurity specialists. Production was gradually restarted after a few days, underscoring the operational impact of such intrusions.
Siemens Energy separately reported a cyber incident affecting its IT environment, although it said its ability to operate and provide services was not significantly affected. While the company stated its ability to operate and provide services was not significantly impacted, it nonetheless initiated measures to contain and resolve the incident. Together, these cases illustrate the need for incident-response plans that protect both business IT and production operations.
Thales chief product officer Jon Geater has highlighted the cybersecurity risks associated with complex industrial supply chains and connected operational technology (OT) systems. Manufacturing remains a major target for ransomware. In Dragos’s analysis of publicly disclosed industrial ransomware incidents, it accounted for 62% of observed industrial ransomware victims in the first quarter of 2026. This consistent targeting underlines a systemic vulnerability.
Dragos reported that manufacturing represented 62% of observed industrial ransomware victims in Q1 2026. In Q2, it identified 1,140 ransomware incidents affecting industrial organisations, of which 747—or 65%—involved manufacturing. The figures underline the continuing ransomware threat to manufacturing and the need for stronger incident response, recovery planning and protection of connected industrial systems.
Vulnerable Points: IoT, Cloud, and Credentials
Thales’s research highlights the risks associated with connected devices and cloud infrastructure. The article should identify the specific report, survey population and question behind the 46% figure before presenting it as a critical-infrastructure statistic. These connected devices, often deployed without adequate security, offer easily exploitable entry points.
In the 2026 Thales Data Threat Report, 35% of respondents identified cloud storage, 34% cloud applications and 32% cloud management infrastructure among the leading attack targets. In OT environments, a cyber incident can affect system availability, control integrity and, in some circumstances, physical safety. IT incidents more commonly involve business systems and data, although their consequences can also extend to production when operational systems depend on compromised IT services.
Credential theft is another important risk. The article should attribute the 66% figure to the exact survey and clarify whether respondents reported an increase in credential theft, credential misuse or both. Attackers can use stolen credentials to gain unauthorised access. Any percentage attributed to Verizon’s 2026 Data Breach Investigations Report should match the report’s precise definition of credential abuse and its denominator.
This tactic proved devastating in March 2026 when an Iranian-linked group used compromised credentials to attack a global manufacturer. The incident caused simultaneous resets across 200,000 devices in 79 countries, halting production and shipping. It demonstrated how a seemingly simple breach can rapidly escalate into a global operational crisis for manufacturing.
The AI Factor in Escalating Cyber Threats
Mike Sewart has highlighted the changing cybersecurity landscape as organisations adopt AI technologies. The article should identify the survey supporting the 68% figure and explain what respondents meant by the pace of change within AI ecosystems. AI may enable some cyber activities to be conducted more quickly or at greater scale, but the article should not imply that AI was involved in the refrigeration attacks without supporting evidence.
Thales’s UK chief technology officer, Mike Sewart, argues that cyber resilience is increasingly important to national security because essential services depend on connected digital systems. The systems that power, connect, and move a country are increasingly digital and interconnected. This creates vast opportunities for efficiency but also more potential routes for disruption.
Thales says its UK technology work includes helping organisations assess and improve the resilience of critical infrastructure. This involves understanding how disruption could spread across interconnected systems and rigorously testing responses before real-world crises emerge. It moves beyond merely stopping an attack to ensuring essential services can continue to operate when something inevitably goes wrong.
The Thales Cyber Resilience Lab in Ebbw Vale provides a setting for testing cyber resilience under simulated conditions. Control-system environments are subjected to simulated cyberattacks without risking live infrastructure, helping organisations test how their technology and people respond to disruption before it happens in the real world. Such exercises can help organisations identify weaknesses, test response procedures and improve recovery plans.
IT/OT Convergence: Expanding Attack Surfaces
Industry 4.0 has increased connectivity between operational technology (OT), corporate IT networks and remote services, although the degree of integration varies between facilities. Industrial IoT sensors, cloud-connected equipment and remote diagnostics can expand the attack surface when they are not adequately secured. An attack on corporate IT can disrupt industrial operations when production depends on shared identity services, enterprise applications, remote-access infrastructure or virtualisation platforms.
This interconnectivity has created a clear pathway for IT-focused attacks to cascade into physical systems, demonstrating the need for integrated security strategies. On 29 December 2025, coordinated cyberattacks targeted more than 30 renewable-energy installations and other Polish energy infrastructure. CERT Polska later reported destructive activity affecting control equipment and systems at targeted facilities, although the attacks did not cause a widespread loss of electricity supply.
In July 2026, Minnesota officials disclosed a coordinated cyberattack affecting more than 30 community water systems. Authorities had not established who was responsible or whether the incidents caused physical disruption to the systems.
As industrial logistics become more automated and connected, manufacturers should assess cybersecurity risks alongside operational performance and safety. Engineers must factor in the cybersecurity implications at every stage of system design and implementation, recognising that a vulnerable IT network can directly expose critical OT infrastructure.
Engineering for a Resilient Industrial Future
The incidents underline the importance of incorporating cybersecurity into industrial equipment design, commissioning, operation and maintenance. Simply reacting to threats as they emerge is no longer sufficient; the focus must shift to designing infrastructure that is inherently capable of adapting as threats evolve. The reported involvement of older Danfoss refrigeration controllers highlights the importance of vulnerability management, supported software, secure remote access and timely security updates.
Manufacturers should adopt a layered security strategy that protects corporate IT, operational technology and the connections between them. Key measures include unique credentials, multi-factor authentication where supported, restricted remote access, regular security assessments and timely patching. Monitoring should identify unexpected changes to equipment settings, unusual login activity and unexplained changes in refrigeration or process conditions.
Regular incident-response exercises should test technical recovery procedures, staff responsibilities, communications and safe manual operation. The work done at facilities like the Thales Cyber Resilience Lab offers a crucial model for this critical testing, allowing organisations to refine their incident response plans in a controlled environment. Where appropriate, independent temperature alarms, safe fallback controls and redundant monitoring can help limit the consequences of a compromised control system.
Furthermore, training for all personnel, from IT specialists to shop-floor operators, is vital. Staff training should cover phishing, suspicious remote-access activity, incident reporting and procedures for responding safely to abnormal equipment behaviour. Understanding the latest phishing tactics and secure operational procedures reduces the likelihood of breaches stemming from internal sources.
Implications for African Industrial Development
As African industries expand digital monitoring, automation and remote equipment management, industrial cybersecurity will become increasingly important to operational reliability. Manufacturing facilities, energy projects and other infrastructure adopting connected control systems should assess cybersecurity risks as part of project design and commissioning. The lessons learned from European and global incidents provide a roadmap for preventative action.
Building robust cyber defences from the outset, rather than retrofitting them, will be crucial for protecting nascent industrial capacity and ensuring uninterrupted operations. This requires strategic investment in skilled personnel, advanced security technologies, and a culture of continuous vigilance across all levels of an organisation. New facilities can reduce some legacy-system risks by incorporating secure remote access, network segmentation, asset inventories and patch-management procedures from the outset.
The continued growth of African manufacturing depends on its ability to maintain secure and reliable operations in an increasingly hostile cyber environment. Cooperation between manufacturers, equipment suppliers, regulators and cybersecurity specialists can improve information-sharing, incident response and protection of critical infrastructure. Protecting these systems is paramount for economic stability and national resilience across the continent.
