Summary
Supermarket fridge attacks in Ireland, France and Sweden have shown how exposed operational technology has become. PLCs, CCTV cameras and building systems sit on the same networks as everything else, yet most are never monitored. This blog explains why OT on a weak network is an immediate danger, how criminals could use it to fake evidence, what NIS2 means for leadership, and why bringing OT into your SOC is the answer.
Operational technology, from programmable logic controllers (PLCs) and industrial control systems to refrigeration controllers, CCTV cameras and building management systems, is now connected to the same networks as everything else. Yet in most organisations it sits outside security monitoring, and attackers have noticed. The answer to the OT security problem is to bring these devices into the same SOC and SIEM monitoring as the rest of your network. Under NIS2, that is now a question of resilience and accountability for senior leadership.
OT attacks are no longer theoretical
In November 2026, SuperValu removed chilled and frozen food from 13 Irish stores after a cyber attack on its refrigeration systems. Stores in Lucan, Blanchardstown, Waterford and Bray were among those affected. In October, attackers hit fridges in around 700 French supermarkets, including Intermarché and Carrefour outlets. Some units overheated badly enough to cause fires, and total losses in France have been estimated in the tens of millions of euros. Intermarché alone put its losses at several million euros. Around the same time as the Irish incident, freezers in Swedish stores climbed to 55°C and the stock inside was ruined.
The French attacks show how simple the method can be. Attackers reached centralised, internet-connected controllers that contractors use to check temperatures remotely. They changed the settings and forced the units into long defrost cycles. Nobody needed to steal data or encrypt a server. They just turned up the heat.
OT on a weak network is an immediate danger
A freezer at 55°C is loud. Staff notice water on the floor, managers pull stock and the story makes the news. The harder question is what happens when attackers get into the same kind of system and choose not to make noise at all.
Fridge controllers, CCTV cameras, access control and building management systems all sit on the network. Most organisations still treat them as facilities kit, managed by contractors and left out of security monitoring. That makes them an ideal place to hide. An attacker who is already inside does not need to break anything. They can watch, wait and quietly game the system for profit.
Put OT on a weak network and the risk is not something for next year’s plan. It is an immediate danger. Default passwords, flat networks with no segmentation and remote access left open to the internet give an attacker a direct path from one compromised laptop or exposed controller to physical equipment. Unlike a data breach, the damage is felt straight away, in spoiled stock, damaged equipment, halted production and, in the worst cases, fires.
CCTV hacking and AI-generated insurance fraud
Barry Rooney, CommSec’s CTO, points to CCTV as a clear example. Many camera systems are poorly secured, and an attacker with access can alter the recorded footage. With the AI tools now widely available, it is realistic to expect criminals to insert convincing slips, trips or falls that never took place. In his view, this is exactly the kind of opportunity a financially motivated attacker would be exploring today.
The logic is simple. Insurers pay out when there is video evidence of an accident on the premises. A fabricated clip that matches the store, the camera angle and the time stamp is far harder to challenge than a witness statement. The retailer, or its insurer, pays the claim. Nobody suspects the camera system, because nobody was watching it.
Digital forensics when CCTV evidence is in doubt
This is where security meets the courtroom. CCTV footage is routinely used to settle insurance claims, defend personal injury cases and support prosecutions. If that footage can be altered, every recording from a compromised system is open to challenge. That cuts both ways. A genuine claim can be dismissed as fake, and a fake one can be paid as genuine.
Proving which is which takes digital forensics. Investigators need to show who accessed the system, when, from where and what changed. That is only possible if the logs exist and someone kept them. A camera network that has never been monitored leaves very little to work with, and a defence built on “we think the footage is real” will not hold up for long.
What an OT security assessment should cover
Most OT security programmes have gaps nobody has looked for. A structured OT assessment starts with an inventory of every device, what it connects to and what role it plays. It reviews the network design for weak segmentation and unexpected routes in, including remote access left open for contractors. It sweeps for signs of compromise and hunts for threats that may already be sitting quietly inside. It also identifies the crown jewels, the systems whose failure would hurt most, so protection goes where it counts rather than spread thinly across everything.
Just as important, a good assessment checks whether an attack would actually be detected. It looks at which data sources are collected, where sensors sit and what the security team can see today. Generic IT assessments often miss this, because OT carries different constraints, different dependencies and very different consequences when things go wrong. An assessment shows where you stand today. Continuous SOC monitoring is what keeps you protected from that point on.
NIS2 and OT security: a board-level question
NIS2 is changing the conversation around OT security. Under the directive, management bodies must approve and oversee cyber risk measures, and they can be held accountable when those measures fall short. For senior leadership, cybersecurity is becoming a question of resilience and accountability, not simply whether the right controls are in place.
That matters most in OT. Many operational environments still run on flat networks, legacy devices and systems that are hard to segment without disrupting production. A fridge controller, a camera recorder and a production line can all sit on the same network as the office PCs. When an attacker gets through the perimeter, that flat design lets them move sideways with very little in the way.
So the questions boards should be asking have changed. If someone gets in, can we contain them, or does the breach threaten the operation itself? Can we limit lateral movement before it reaches the systems that keep us trading? And can we keep operating through an incident, rather than shutting down until it is over? Prevention alone will not satisfy NIS2. Organisations need to show they can detect a breach, contain it and keep running, and that starts with seeing what is happening across their OT.
The answer: bring OT security into your SOC
The most effective answer to the OT security problem is SOC monitoring. Attackers usually reach OT through the IT side. That means the same SOC monitoring that catches an intruder heading for a file server can catch one heading for a fridge controller or a camera recorder. Logins, remote sessions, configuration changes and unusual traffic all show up, but only if those devices are in scope. Where kit is exposed directly to the internet, the first job is to close that door and move remote access behind a secure VPN, then update firmware and change default passwords.
When monitoring is in place, an incident like this can be spotted early and handled as a precaution rather than a crisis. That is the standard every organisation should aim for. Fridges, CCTV cameras, building systems and production lines are all on your network. If your SOC is not watching them, nobody is. And if the criminals are already inside, you want to find them before they start rewriting the evidence.
Speak to us about protecting your OT environment through our Managed SOC.
Frequently asked questions
What is OT security monitoring?
OT security monitoring is the continuous monitoring of operational technology, such as industrial controllers, refrigeration systems, CCTV and building management systems, for signs of attack. It uses the same logs and network traffic a SOC already analyses for IT, including logins, remote sessions and configuration changes.
Can a SOC monitor OT devices?
Yes. Attackers usually reach OT through the IT network, so a SOC that monitors network traffic can detect them moving towards OT systems. OT devices can also feed their logs into a SIEM, as long as they are brought into scope.
Does NIS2 apply to OT?
NIS2 covers the network and information systems that in-scope organisations rely on, and that includes OT. Management bodies must approve and oversee cyber risk measures, so OT resilience is now a board-level responsibility.
How were the supermarket fridges hacked?
In the French incidents, attackers accessed internet-connected refrigeration controllers that contractors use for remote temperature monitoring. They changed the settings to force long defrost cycles, which warmed the units and spoiled the stock.
Sources
- SuperValu removes frozen and chilled food from 13 stores after cyber attack on fridges, The Irish Times
- Hackers hijack Swedish supermarket fridges, Cyber Security News
- The French supermarket fridge hack that made cyberattacks physical, Forbes
- 2026 French supermarket refrigerator hack, Wikipedia