Supermarket OT attacks put refrigeration cybersecurity in focus

A second wave of suspected cyberattacks targeting refrigeration systems in supermarkets across Sweden, Belgium, and Luxembourg has reignited concerns about the security of operational technology (OT) in retail environments. The incidents follow a reported attack on cooling equipment in hundreds of French stores just weeks earlier, which allegedly caused significant food losses. While investigators have not yet confirmed the attack vectors, the pattern points to a growing vulnerability in how retailers manage external connectivity to critical physical infrastructure.

Secomea, a Copenhagen-based industrial cybersecurity company, used the incidents to highlight what it describes as a structural gap: remote access to OT systems is operationally essential, but frequently managed with insufficient granularity or oversight.

The OT remote-access problem

Modern refrigeration systems in large retail chains depend on remote connectivity. External service providers and maintenance technicians need it to monitor temperatures, respond to alarms, and diagnose faults across hundreds or thousands of locations. The problem, as Secomea frames it, is not the connectivity itself but the controls around it.

"Many organisations have invested heavily in securing their corporate IT environments, but operational equipment often presents a different challenge," said Michael Ferdinandsen, chief executive of Secomea. "These systems were designed to operate reliably for years, sometimes decades. They weren't necessarily designed with today's connectivity and cybersecurity requirements in mind."

Unlike conventional data breaches, attacks on OT carry immediate physical consequences: spoiled food, interrupted cold chains, financial losses, and potential food safety incidents. When multiple external suppliers each use different access methods, maintaining consistent oversight becomes difficult for security teams already stretched across IT and OT domains.

Secomea's own product, an OT-native secure remote access platform using edge gateways deployed close to individual assets, is positioned by the company as a purpose-built alternative to repurposed IT remote-access tools. The platform offers centralised access management, granular per-asset permissions, and audit logging. The company cited AK-Centralen, a Danish refrigeration monitoring specialist, as a customer using Secomea technology to support remote monitoring of cooling systems across more than 1,500 supermarkets in Denmark.

Regulatory and competitive context

The incidents arrive as the EU's NIS2 Directive, which came into force in October 2024, extends mandatory cybersecurity obligations to a broader range of critical and important entities, including food supply chains. Retailers operating at scale across EU member states should now have incident-response and supply-chain security obligations in scope; attacks on OT that cause physical disruption would likely meet NIS2's reporting thresholds.

The broader OT security market is expanding rapidly. Vendors including Claroty, Dragos, Nozomi Networks, and Armis compete on asset discovery, anomaly detection, and network segmentation for industrial environments, while secure remote access specifically is contested by Secomea, Tosibox, and Zscaler's OT-adjacent offerings. The retail vertical has historically lagged manufacturing and utilities in OT security investment, a gap these incidents may accelerate vendors to address.

Outlook

Ferdinandsen argued that retailers should not treat secure access and operational continuity as a trade-off. "The goal is to enable the remote support that modern operations depend on, while giving IT and security teams the governance and control they need," he said.

The precise methods behind the latest suspected attacks remain under investigation, and Secomea's release does not name any affected retailers or cite a law-enforcement or regulatory source for the incident reports. Independent corroboration of the attack details would strengthen the editorial basis for the story. Editors should note this release originates from a vendor with a direct commercial interest in the narrative.