Supermarket Refrigeration Attacks: The Cold Chain Is an OT Risk
After France, attacks on supermarket refrigeration systems have reached Italy, causing physical damage to stock. Here is what is known as of 4 November 2026 and what to check in your own facilities.
On 3 November 2026, Automazione Plus reported that the wave of cyberattacks against supermarket refrigeration systems, already seen in France and more broadly across Europe, has now reached Italy. The picture is still partial, and several key details are either not public or not verified. This article therefore separates what has been reported from what remains open.
What has been reported
According to the sources, several retail stores in Sicily were hit, including some Coop supermarkets in the provinces of Palermo and Catania. The attackers reportedly tampered with the control systems of the refrigerated display cases: temperatures were altered and food spoiled. The Polizia Postale (Italy's postal and cyber police) is working to trace the origin of the attacks.
The article preview also states that the industrial controllers were allegedly compromised remotely and driven up to 50 °C, destroying stock, and that an urgent summit was reportedly held at Palazzo Chigi, with IT/OT convergence in the retail sector treated as a national security issue. These details come only from the preview and should be considered unconfirmed, as should the start date of the attacks, given as mid-October in a sentence that is truncated.
What the security vendors say
Nozomi Networks, through Moreno Carullo, calls OT "the new critical front," and the article frames the attacks as part of hybrid warfare. That attribution comes from the article's description and has not been independently confirmed. Claroty, for its part, discusses the threats, including those linked to artificial intelligence, and the measures needed to secure facilities. Its specific recommendations have not been analyzed in detail here.
What we don't know
The following are not currently known:
- the brands or models of the controllers involved;
- the access method used by the attackers;
- who is responsible;
- the number of stores and countries affected.
Why this matters even if you don't run supermarkets
Refrigeration controllers are ordinary OT assets: PLCs and regulators of the same type are found in food plants, pharmaceutical facilities and cold-chain logistics. The case shows that remote exposure of these devices can cause direct physical and economic damage without compromising any complex IT system. A modified setpoint is enough to destroy a load.
A tampered temperature setpoint is physical damage, not just a cyber incident.
What to check now
Whatever details are still missing, this is a good time to review a few points:
- Remote access: inventory who can reach controllers from outside the network, including maintenance staff and vendors, and eliminate direct exposure to the Internet; prefer strongly authenticated, logged and time-limited access.
- IT/OT segmentation: verify that refrigeration and control networks are separated from the corporate network and store systems, with minimal, documented traffic rules.
- Setpoint monitoring: watch not only measured temperatures but also changes to control parameters, with alarms on anomalous variations and on values outside permitted limits.
- Independent protections: consider alarms and safety probes that do not depend on the same controller or network.
- Incident response: define in advance who intervenes, how to switch to manual operation, and how to document stock losses.
Conclusion
The information available as of 4 November 2026 is incomplete and some of it remains to be confirmed, but the direction is clear: the cold chain is now a concrete target. Following the investigation is worthwhile. In the meantime, reducing remote exposure, segmenting networks and monitoring setpoints are measures that hold up in any scenario and cost little compared with the potential damage.