"Hackers reportedly compromised refrigeration controls at around 700 supermarkets across France, remotely raising temperatures to as high as 50 degrees C."
The European refrigeration attacks and global echoes
In October, refrigeration controls at roughly 700 French supermarkets were reportedly manipulated so temperatures climbed to as high as 50 degrees C. Over the following week, similar incidents were reported in Belgium, Luxembourg, Sweden, Finland, Ireland and Estonia. Refrigeration systems at three French blood‑storage facilities were also targeted. The incidents were not confined to Europe: the Pentagon is investigating a suspected cyberattack after unexplained refrigeration failures at commissaries across at least six US military bases in early August. The October attacks were attributed by French authorities to an Iranian Revolutionary Guard cyber unit, although responsibility for the subsequent incidents remains less clear.
Internet‑connected operational technology as an access point
Those attacks exploited poorly secured, internet‑connected operational technology (OT). The incidents show how devices and controls once isolated inside facilities are now reachable over networks, creating entry points into systems that were rarely exposed. Without destroying infrastructure or using conventional weapons, attackers manipulated everyday systems — refrigerators and refrigeration controls — to produce tangible disruption: spoiled stock, interrupted blood storage, and an erosion of public confidence.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleInterdependencies: why a hacked fridge is a national security problem
The core national security concern is systemic, not narrowly technical. Critical infrastructure is an interconnected system of systems: physical infrastructure relies on digital networks, which in turn depend on power, telecommunications and physical assets; and all of it is underpinned by people, logistics and global supply chains. The article uses Australia’s food system to illustrate the point: agriculture depends on energy, water, fertiliser, fuel, machinery and communications; once food leaves the farm, processing, refrigeration, warehouses, transport networks, ports and distribution centres become equally important. Disruption of any one component can ripple across availability, movement and affordability of food far beyond the immediate location of the incident.
ASD guidance and the challenge of isolating systems
Australia’s national cyber agency, the Australian Signals Directorate (ASD), responded to the European incidents by urging businesses to assess vulnerabilities in internet‑connected OT and to secure remote access. ASD’s Critical Infrastructure Fortify guidance specifically encourages operators to develop the capacity to isolate critical systems from other networks for up to three months while maintaining essential services. Those measures are aimed at strengthening the resilience of individual operators, but the guidance also underscores that a broader, cross‑sector understanding of dependencies is required to anticipate and manage cascading disruption.
ASIO, state‑sponsored actors, and strategic pre‑positioning
Australia’s security intelligence agency has been explicit about the strategic dimension. The country’s 2025–26 Annual Cyber Threat Report confirms state‑sponsored hacking groups target Australian critical infrastructure for espionage and potential pre‑positioning for disruptive or destructive attacks. Last year, the Australian Security Intelligence Organisation (ASIO) assessed that espionage and foreign interference were at extreme levels and warned that authoritarian regimes are increasingly willing to disrupt or destroy critical infrastructure to impede decision‑making, degrade warfighting capabilities and sow social discord. ASIO also said cyber units from at least one nation state routinely seek to explore and exploit Australia’s critical infrastructure networks and are almost certainly mapping computer systems to enable the deployment of malware or maintain access for future use. In its 2026 threat assessment, ASIO identified energy and communications infrastructure, plus any infrastructure that supported the military, as priority targets.
What this means for technologists and security teams, policymakers and regulators, and the general public
- Technologists and security teams: ASD’s advisory and Fortify guidance put a practical test in front of operators — find and secure internet‑exposed OT, harden remote access, and build the capability to isolate critical systems for extended periods without losing essential functions.
- Policymakers and regulators: ASIO’s warnings and the cross‑border pattern of incidents highlight the need to map interdependencies across sectors, align fragmented ownership and responsibility, and coordinate investment cycles and security priorities across government and private operators.
- The general public and service users: everyday conveniences and essential services — from supermarket refrigeration to blood storage and military commissaries — are now vulnerable points in broader strategic competition, with downstream effects on supply, prices and public confidence.
The European and US refrigeration incidents offer a clear lesson for Australia: protecting individual assets is necessary but insufficient. The greater risk is strategic — that state‑sponsored actors will map, access and hold critical infrastructure networks in reserve, to be activated in a crisis. The immediate, concrete test will be whether operators can build the capacity to isolate critical systems for up to three months while maintaining essential services, as ASD’s Fortify guidance recommends. If they cannot, the consequences could reach well beyond spoiled goods and broken chillers to the country’s ability to sustain economic activity and support defence operations under pressure.
