Late Sunday night, a still-unknown cybercriminal or group hacked thousands of remote‑controlled refrigeration systems across hundreds of French grocery stores, spiking temperatures, spoiling food, and sparking fires.
The French supermarket refrigeration hack
The October incident in France — reported late on a Sunday — is the latest demonstration of a trend that moves beyond data theft and into physical disruption. According to the account, thousands of internet‑connected refrigeration units in hundreds of stores were compromised, resulting in food spoilage and at least some fires. The intruders appear to have exploited unpatched firmware on devices that have “no digital value,” in the words of Matt Hayden, vice president for cyber and emerging threats at General Dynamics Information Technology, who commented on the case by email.
ServiceNow Armis Labs: building automation systems as leverage
ServiceNow’s Armis Labs report, published earlier this month, highlights how building automation systems (BAS) — which manage HVAC, lighting, energy, water, badge readers, door locks, surveillance and fire alarm panels — have become a focal point for extortion. The report found that 73 percent of organizations own BAS that have been used in ransomware attacks, and that the same 73 percent have known exploited vulnerabilities in at least one BAS. Armis Labs also reported that 91 percent of BAS communicate over insecure protocols, widening the attack surface for adversaries.
“Today’s BAS operate at the intersection of IT and OT worlds, creating unprecedented exposure,” the report states, and ServiceNow’s senior director of threat research, Michael Freeman, told The Register that attackers often use BAS as a place to hide and persist because these systems generally have fewer security controls and require high uptime.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadSemperis incident, and the raw leverage of physical effects
Not all intrusions rely on encryption or data theft to extract payment. Tim Beasley, a senior incident response consultant at Semperis, recounted a case where a threat actor used physical denial to increase pressure on a customer. Beasley said police had to break glass to regain physical access after attackers “locked everybody out.” When asked whether the victim paid the ransom, Beasley shouted, “Oh, hell, no!” — a shorthand for responses organizations may give even while facing real‑world disruption.
Dragos telemetry: ransomware rising against industrial and OT targets
Dragos, which tracks ransomware claims and disclosed intrusions affecting industrial sectors, reports a sustained rise in attacks. The firm tracked 995 ransomware attacks against industrial organizations in 2023 — a 49.5 percent increase from 2022 — and recorded a further acceleration in 2024. Dragos reported that 119 ransomware groups impacted more than 3,300 industrial organizations in 2025, and that incidents continued to increase in 2026 with 1,020 incidents in Q1 and 1,140 incidents in Q2.
“The vast majority of cases are opportunistic,” Abdul Alamri, a senior threat analyst at Dragos, told The Register. Dragos estimates fewer than 10 percent of OT networks worldwide have sufficient network monitoring in place, and in 30 percent of response cases in 2025 investigations began not from an alert but because someone noticed that “something seemed wrong” in operations.
AI, obscure operating systems, and the refrigeration example — what this means for refrigeration owners, regulators, and OT security teams
- Refrigeration owners and facility operators: expect attackers to keep probing internet‑connected compliance systems. Hayden warned that units connected for compliance — so owners can demonstrate temperature histories to regulators — create a remote attack vector when firmware goes unpatched.
- Regulators and compliance officers: the refrigeration case shows that connecting hardware to prove regulatory compliance can inadvertently open avenues for disruption; Hayden suggested such connectivity can be “a vector in which that particular refrigerant unit could be targeted for disruption.”
- OT security teams and IT defenders: ServiceNow and Dragos both underscore the need for visibility and monitoring. Freeman and analysts at Dragos warned that BAS and OT systems often lack traditional security controls, and that AI is lowering the barrier for attackers to understand obscure OSs like VxWorks and other legacy systems — enabling adversaries who are not OT experts to cause physical consequences.
Taken together, the facts in this report sketch a straightforward, uncomfortable picture: as organizations harden IT, attackers shift to devices that bridge digital controls and the physical world. The French refrigeration hack and the statistics from Armis Labs and Dragos show that these are not hypothetical threats but active vectors — exploited because they combine weak monitoring, insecure protocols, unpatched firmware and high leverage over operations. Whether the response will be faster patching, network segmentation, stricter limits on internet connectivity for compliance devices, or new regulatory safeguards remains to be seen; for now, the bills are coming due in fridges and server rooms alike.
