By Maddie Abe
I went to a grocery store last weekend to pick up a few things, including milk and cheese. The refrigerator wasn't working, so I had to make another stop at a different shop.
It was a small inconvenience. The fridge had malfunctioned, and I got on with my day.
Then I came across the news about cyberattacks affecting refrigeration systems at several supermarket chains in France.
Reports* described cyberattacks affecting hundreds of supermarkets across France, with refrigeration systems manipulated to raise temperatures as high as 50°C. The disruption led to widespread food spoilage and fires at some locations. France’s cybersecurity agency subsequently confirmed that systems from multiple refrigeration technology providers had been affected. While outdated firmware and internet-exposed interfaces have emerged as potential security concerns, investigators have yet to publicly establish the precise method used in the attacks or identify those responsible.
I realised how much we rely on systems that we rarely give a second thought to until they stop working. We tend to think of them as everyday appliances, not cyber targets. But when the technology behind them is deliberately disrupted, the challenge may go well beyond getting the equipment working again.
This is what makes OT security different. The concern isn't just whether a system has been compromised, but what that compromise means for the operation it supports.
When technology supporting a physical operation is disrupted, the first challenge is understanding the extent of the impact. Which systems have been affected? What depends on them? Can the operation continue safely while the situation is being assessed?
In heavy industry, answering these questions isn't always straightforward. Equipment and processes can be interdependent, and taking one system offline may affect others. Even when the immediate problem is contained, bringing everything back online may require careful planning to avoid creating further operational or safety risks.
The response is therefore about more than containing the cyber threat. Teams need to understand what has happened, assess the consequences for the operation and decide what can safely continue running, often before they have a complete picture of the situation.
Refrigeration is something most of us barely think about. We expect the fridges in a supermarket to keep food cold, just as we expect industrial equipment to perform its job and essential services to keep running.
But the more connected these environments become, the more difficult it can be to separate a cyber issue from its operational consequences.
In heavy industry, the challenge isn't necessarily knowing that a system is vulnerable or that a risk exists. It's navigating the reality that equipment, processes and business priorities are interconnected, and that addressing one risk can have implications elsewhere.
That tension is what I find particularly interesting about OT security. The question isn't always whether a risk can be identified. Sometimes it's what happens when the available options all come with trade-offs
My trip to the grocery store was a minor inconvenience. I went somewhere else and bought my milk and cheese.
For an organisation that depends on connected physical systems, the consequences of a failure can be much harder to work around. And when that failure involves a cyberattack, the organisation may have to make decisions without knowing which systems or connections it can still trust.
That is why I think the OT security conversation needs to go beyond vulnerabilities and technical controls. It also needs to consider the decisions organisations face when systems fail, the risks cannot be eliminated immediately, and keeping the operation running safely is still the priority.
As I work through the research for OT Security Sydney 2027, I'm keen to explore these questions with people working across cyber security, engineering and operations.
I'd be interested to hear how these challenges play out in practice:
When a security response could disrupt operations, who makes the final call?
How are you managing remote and third-party access as your environment becomes more connected?
What happens when a system needs attention but can't realistically be patched or replaced?
How confident are you that your operation could continue safely if a system it depends on could no longer be trusted?
There may not be straightforward answers, particularly in environments where the consequences of getting it wrong extend beyond the digital world.
Ultimately, OT security is about more than the technology itself. It's about what depends on it, what's at stake when it fails, and how to keep operations safe when the decisions aren't straightforward.
And on a more personal note, it leaves me wondering: when choosing our next fridge or household appliance, should cyber security be part of the decision, too?
For speaking and interview opportunities on cyber leadership topics, feel free to reach out to Maddie Abe.
Join us to share your insights at our upcoming events: