What happened

On Sunday, October 11, attackers took remote control of refrigeration systems in about 700 supermarkets in France and forced the units into continuous defrost cycles, pushing temperatures up to 50°C (about 122°F). Paris prosecutors say the attack also caused fires. The equipment involved was older refrigeration control systems, mostly from the Danish manufacturer Danfoss, that no longer get security updates. The attackers may have found them simply by searching the internet. Exactly how they got in is still unknown, and no one has claimed responsibility, asked for money or stole any data.

Why this matters to business leaders

This was an OT attack, and OT is where cyber becomes physical. IT is technology that handles information: email, files, computers, etc. OT (operational technology) runs physical equipment: refrigeration, heating and cooling, building controls; and in energy, the equipment that monitors and controls wells, pumps, pipelines and compressors. When IT is attacked, you lose data. When OT is attacked, things stop working or break. Nobody stole a file in France. They spoiled the inventory and started fires.

The attackers didn’t need to be clever. Defrost is a normal function. The attackers simply used it the wrong way for too long, on purpose. That’s the pattern worth paying attention to. The most damaging attacks aren’t always the most sophisticated. Hackers find a system that is already reachable and use it as designed, against its owner.

Old equipment isn’t the problem. Visible old equipment is. OT is build to run for 15 years or more. The software inside it is not. Most companies have equipment that is past its update life, and that alone is a maintenance issue. It becomes a business risk when that equipment can be found and reached from the internet. Replacing everything isn’t realistic. Knowing what an outsider can see is.

One supplier, hundreds of sites. The same controllers were installed across multiple retail chains and multiple countries. A weakness in one widely used product became hundreds of incidents in a single night. Energy operators should recognize this pattern. Field equipment, remote monitoring and vendors who service them are often shared across the entire basin.

No ransom doesn’t mean no cost. France supermarket retailer Intermarché’s CEO estimated losses in the tens of millions of euros nationwide in a single day. Retailer Coopérative U said larger stores could each lose up to €200,000 in stock. Add time to restore and verify equipment, lost sales, and the safety questions. The bill for the physical disruption arrives fast.

For energy, the stake are higher. A grocery store can throw out spoiled food and restock; although cost and time does need to be factored in.  A changed setting at a remote well site compressor station or pipeline can mean lost production, damaged equipment, environmental exposure or worse. Many of these sites are hours from the nearest person and connected over cellular. The supermarket story is the energy story with lower stakes.

What to ask your IT team

Do we have a list of the OT that could do damage if someone changed a setting? GOOD ANSWER: “Yes. Here it is by site, including field equipment, building systems and anything we manage remotely, with a named owner for each.”  RED FLAG: “That’s operations, not security,” a list that only covers computers and servers, or a long pause.

Can any of it be reached from the internet? GOOD ANSWER: “We checked recently, from the outside, the way an attacker would, including anything connected over cellular. Here’s what we found and what we’ve closed off.”  RED FLAG: “It’s behind the firewall,” with no one able to say when that was last checked.

Which of our systems no longer get security updates? GOOD ANSWER: These systems, at these sites. Each has a replacement date, and until then it’s cut off from the internet or walled off fro the rest of our network.” RED FLAG: “It still works, so we kept it.”

Who outside the company has remote access? GOOD ANSWER: “Here’s the current list of vendors and contractors. Each has its own protected login, access is turned on only when needed, and we reviewed the list within the last few months.” RED FLAG: Shared logins, or “the vendor handles that.”

Could we run without it? GOOD ANSWER: “We’d know quickly, because unusual setting changes trigger an alert that someone is watching. Each site can switch to manual operation, and we’ve practiced it.” RED FLAG: A plan nobody has tested, or “we’d figure it out.”

Where to start

 You don’t have to solve everything at once. Two steps give you a clear picture quickly. First, look at your company from the outside, the way an attacker would, to see which systems and equipment are visible and reachable from the internet. Most companies are surprised by what turns up. Second, test what you find. A system being visible tells you there’s a door; testing tells you whether it opens. Together, they turn “we think we’re fine” into a list of real gaps and a plan to close them.

The bottom line

Cybersecurity is no longer just about protecting your data. It’s about protecting the equipment that keeps your business running.

Any OT that can be reached from the internet, runs on outdated software or is open to outside vendors is a way in, and France showed that attackers don’t need to be sophisiticated to do real damage with it. The companies that come through incidents like this are the ones who know what they have, who can reach it, and how to keep running without it.