Supermarket Fridge Attacks: The Cold Chain Is an OT Target
According to Automazione Plus (3 November 2026), attacks on retail refrigeration systems that began in France have reached Sicily. A concrete case for anyone who programs and manages PLCs.
On 3 November 2026, Automazione Plus reported that a wave of cyberattacks against supermarket refrigeration systems across Europe had reached Italy. In Sicily, several retail outlets were reportedly hit, including some Coop supermarkets in the provinces of Palermo and Catania. The attackers allegedly tampered with the control systems of the refrigerated display cases, changing temperatures and damaging the stock.
The Polizia Postale (Italy's postal and cyber police) is investigating the origin of the attacks. This article is based on the information available at the time of publication (4 November 2026), which is still incomplete.
What we know so far
According to a second article, the industrial controllers were reportedly breached remotely and driven to a temperature of 50 °C. It mentions destroyed goods and an emergency summit at Palazzo Chigi. The campaign reportedly began in mid-October, "from France to Sicily", and IT/OT convergence in retail is described as a national security issue.
On the vendor side, Nozomi Networks calls OT "the new critical front", and the article's meta description frames the cold chain as a target of hybrid warfare. Claroty, for its part, analyzes new AI-related threats and the measures needed to protect plants.
What we don't know yet
Before drawing technical conclusions, caution is appropriate. The sources consulted do not allow us, for now, to confirm:
Points not yet verified:
- which PLC or controller brands were involved;
- what the attack vector was (for example, exposed remote access);
- how many stores were affected;
- whether there is any attribution;
- what specific countermeasures Claroty and Nozomi recommend.
Professionals in the field should read the full articles and wait for the outcome of the investigation before treating these points as established.
Why it matters to automation engineers
The case is instructive even without the details. This is not a complex process plant, but ordinary refrigeration systems controlled by PLCs or equivalent controllers, manipulated to cause physical damage: spoiled goods. The risk is not only data theft, but the alteration of a setpoint with immediate real-world consequences.
A refrigerated display case is a physical process with a setpoint: if someone changes it remotely, the damage is material.
Practical takeaways
Even without knowing the vector, the general good practices for this kind of scenario are well established and remain valid:
- Reduce remote access exposure: no controller or interface directly reachable from the Internet; access via VPN, strong authentication and session logging.
- Segment the network: separate store OT from IT and other networks, limiting traffic to what is strictly necessary.
- Change default credentials and disable unused services and ports on controllers.
- Program defensively: plausibility limits on setpoints, independent temperature alarms and safety logic that does not depend on a single value that can be changed remotely.
- Take care over commissioning: document the configuration, verify security settings at commissioning and maintain an inventory of connected assets.
- Plan for monitoring: detect anomalous parameter changes and have a response plan with manual or local mode.
In summary
If the reports of 3 November 2026 are confirmed in detail, the case will show that even OT in distribution and logistics has become a target. For engineers and integrators the message is practical: security must be considered from design and commissioning onward, not bolted on afterwards.