Sometimes it’s not doing the simple things...

Sometimes it’s not doing the simple things that can have devastating impact

An unchanged password. An exposed controller. A business brought to a standstill.

A fridge does not need access to your customer database to cause a business crisis. Sometimes, all an attacker needs is the ability to stop it keeping things cold.

For supermarkets across Europe, that risk has become painfully real. Recent attacks on connected refrigeration systems have spoiled food, emptied chilled displays and disrupted trading. They are a reminder that cyber security is not just about protecting laptops and email. It is about protecting the equipment your business depends on to operate. 

When remote management becomes a route to disruption

In October 2026, hundreds of French supermarket stores were affected by attacks on refrigeration controls. Further incidents were reported across several European countries in early November, with retailers discarding chilled and frozen stock. At least one store reported temperatures reaching 50°C. This was serious disruption at stores across multiple chains, rather than evidence that every affected chain was taken completely offline.

These were not simply domestic smart fridges. Commercial refrigeration systems use central controllers to manage cooling, defrost cycles, monitoring and alarms. Remote access allows contractors to diagnose faults and adjust equipment without visiting every site. The convenience is genuine; the danger comes when powerful management controls are left reachable over the public internet without adequate protection. 

Reporting on the French incidents identified legacy technology connected to the internet with default passwords. France’s national cyber response team, CERT-FR, confirmed numerous compromises and explicitly recommended changing default passwords, updating firmware and removing direct internet exposure. 

Default passwords are part of the reported picture, but not the whole story. Authentication weaknesses and outdated software also matter, and the official alert does not establish the same entry point for every incident. Changing a password is essential basic hygiene—not a substitute for securing the system around it. 

The dangerous assumption: “It’s working, so it must be fine”

A default password is often a shared starting credential, not a secret unique to your business. Leaving it unchanged can mean that someone who knows the product’s standard login knows yours too. The NCSC warns that criminals can use default passwords to access smart devices and potentially the local network.

The deeper problem is complacency. A device gets installed, remote support starts working and the project is marked complete. Security settings, software updates and replacement dates become somebody else’s responsibility—or nobody’s. The equipment may keep doing its job for years while its security falls further behind.

Responsibility can also fall between the business, its IT provider and a specialist installer. Who changes the password? Who maintains the controller? Who checks how the contractor connects? Unless those responsibilities are explicit, everyone can assume someone else has dealt with them.

Changing default credentials is a basic safeguard, but it belongs alongside supported firmware, controlled remote access, monitoring and an agreed owner for each device. A stronger password cannot repair an authentication bypass or make unsupported equipment safe to expose to the internet. 

“It’s only a fridge” is not a risk assessment

A refrigeration controller might not look like critical infrastructure. For a food retailer, however, it helps protect the stock the business exists to sell. Its importance comes from the consequences of failure, not whether anyone has formally labelled it critical national infrastructure.

The same principle applies to connected heating, access control, environmental sensors and production equipment. Ask what would happen if a device stopped working—or started following the wrong instructions. Could you still trade, protect your stock, access your premises or deliver your service?

The supermarket incidents show that attackers do not always need to steal data to cause damage. Disrupting the physical operation can be enough.

A device’s importance comes from what happens when it fails—not whether you think of it as IT.

The NCSC’s warning: prepare before the shelves are empty

On 3 November 2026, the National Cyber Security Centre’s warning to businesses was stark: failure to act on known cyber risks can have consequences extending to empty shelves, interrupted services and business failures. Its message was not simply to buy more technology, but to address weak technology and operational foundations that have been tolerated for too long. 

You do not have to run a supermarket to take that warning seriously. Every organisation has dependencies. Some sit in a server room; others sit on a wall, above a ceiling or behind a refrigerated cabinet. Overlooking them does not make them less important.

How many connected devices are on your business network?

Think beyond computers and phones. Internet of Things (IoT) equipment can include CCTV cameras, door-entry systems, smart TVs, heating controls, sensors and connected appliances. Commercial controllers are often described as operational technology, or OT. Whatever the label, they need to be included in your security planning.

Ask yourself:

• What is connected? Do you have an up-to-date inventory, including equipment installed by external contractors?
• Who looks after it? Is someone responsible for credentials, updates, supplier access and replacement?
• Are default passwords still in use? Have administrative accounts been checked and given strong, unique credentials?
• How is it reached remotely? Is access controlled, or is a management interface exposed directly to the internet?
• Where does it sit? Does it share the main network with staff computers, servers and sensitive data, or use a properly segmented network?
• What happens if it fails? Have you considered operational disruption as well as data theft?

One insecure device can become a foothold inside your network

A connected device does not have to contain valuable information to be useful to an attacker. If compromised, it may provide a foothold from which to attempt access to other systems. That possibility is why the NCSC warns that insecure smart devices can put the local network at risk. 

On a flat network, where devices can communicate too freely, an attacker may have opportunities to move sideways towards business systems. Success is not automatic: it depends on permissions, vulnerabilities and other defences. But placing an unnecessarily exposed device beside sensitive systems creates avoidable risk. The breach can move from an overlooked appliance towards the inside of the business.

Segmentation creates boundaries. A dedicated IoT or equipment network, with enforced firewall rules, can restrict access to staff devices, servers and sensitive data. Only the connections needed for the equipment’s legitimate purpose should be allowed. A separate Wi-Fi name or a VLAN alone is not protection if unrestricted traffic can still pass between networks.

Segmentation also does not protect an appliance whose management page remains open to the internet. Remote access must be secured too. CERT-FR recommends restoring refrigeration-management access only through a secure VPN or protected network, alongside vendor security measures. 

For operational equipment, agree changes with the relevant supplier so that monitoring, alarms and essential services continue to work. Isolation reduces the potential impact of a compromise; it does not replace patching, strong credentials or replacement of unsupported devices.

What does this mean for your business?

You cannot protect what you have not identified. And you should not have to wait for an incident to discover that an overlooked device had access to far more of your network than it needed.

At The Silver Cloud Business, we can arrange a network discovery scan to help identify the devices connected to your network, investigate unfamiliar equipment and review how it is separated from your business systems. We can then discuss the option of creating a dedicated, restricted network for IoT and other higher-risk equipment, partitioning it away from sensitive data and day-to-day operations.

A scan is a starting point, not a guarantee that every device or weakness will be found. We combine discovery with a review of network records and supplier information, and agree suitable methods for sensitive or older equipment. The aim is a clearer inventory, practical priorities and a proportionate plan to reduce risk.

Call The Silver Cloud Business on 01722 411 999 to discuss a network scan and whether a dedicated IoT network is right for your business.

The simple things are easy to put off. The consequences are not always easy to put right.