The second wave of refrigerator cyberattacks in a month should end any debate about whether operational technology is a soft target. It is. Attackers have now shown, twice in quick succession, that the cooling aisle is reachable and that the consequences land on shoppers in the form of spoiled food and thin shelves. Treat this as a supply chain problem, because that is what it is.
The pattern is familiar from other sectors. South Korea's financial institutions are confronting a new wave of AI-powered cyber threats, and the lesson there is the same one supermarkets are learning now: attackers go after the systems that keep daily life running because disruption is the point. Google's work on a smarter shield against token theft for OAuth security points in a more encouraging direction, showing that identity defenses can be strengthened at the platform level. But refrigerators and the networks that manage them rarely benefit from that kind of attention. They sit in the operational layer, where patching is slow and connectivity arrived faster than security did. The PHP flaws now under active attack, flagged by a U.S. cyber agency, reinforce how quickly known weaknesses become live incidents when maintenance lags.
The practical takeaway is direct: any retailer connecting cooling equipment to a network needs to treat that equipment as critical infrastructure, with the same monitoring, segmentation, and incident response applied to payment systems. Ask the uncomfortable questions now. What happens when a controller is compromised at 2 a.m.? Who can shut a case down and keep the cold chain intact? Does the security team even have an inventory of every connected device in the store? Most organizations cannot answer all three, and attackers are counting on that.
There is a human cost buried in the technical story. Spoiled food means waste, lost margin, and empty shelves for customers who have few alternatives. A retailer that cannot keep refrigerators running cannot keep promises, and trust erodes faster than inventory. The next wave may not stay confined to Europe, and it may not announce itself with spoilage alone. Watch whether regulators begin classifying supermarket refrigeration as essential infrastructure, and whether retailers publish what they have changed. The silence on that question will tell you as much as any incident report.