Analysis
When Cyberattacks Hit the Physical World
October 12, 2026 · Author: Lisbeth Loft
When cyberattacks affect physical processes, cybersecurity becomes a matter of operations, dependencies, and risk management – not just data protection.
A cyberattack does not have to steal data or take down a website. When digital systems control physical processes, the consequences can include spoiled goods, operational disruptions, and, in the worst cases, impacts on critical functions.
In France, approximately 150 Intermarché supermarkets were affected by a cyberattack on October 12, in which refrigerated display units were manipulated, causing temperatures to rise to as much as 50°C for several hours. The affected products subsequently had to be discarded to protect food safety.
The incident is interesting because it illustrates something that is easily overlooked in cybersecurity: Digital attacks can have very tangible physical consequences. Data and traditional IT systems are not necessarily the primary targets. The systems that keep a business running can be just as vulnerable. These are precisely the types of systems commonly referred to as operational technology (OT) – technology used to monitor or control physical processes.
When Digital Connections Become Operational Dependencies
Refrigeration systems, ventilation, building management systems, and production equipment are increasingly connected to digital networks. This enables remote monitoring, control, and maintenance. However, it also means that systems which previously operated in relative isolation become part of an organization’s broader digital attack surface.
At the same time, these systems are not always managed by the organization itself. External suppliers may have access for monitoring, servicing, and remote control. This creates dependencies that are not necessarily visible within the traditional IT organization.
Risk Management Must Start With the Consequences
The French incident illustrates why risk management requires more than an overview of IT systems and technical vulnerabilities. Organizations must also identify the physical processes that depend on digital systems and assess how failures, manipulation, or loss of access to these systems could affect operations.
A risk assessment should therefore consider not only the likelihood of a cyberattack but also its potential consequences for operations, finances, safety, and service delivery. Based on this assessment, organizations can prioritize appropriate security measures, including restricting remote access, monitoring critical systems, and establishing options for manual operation or rapid recovery. NIS2 similarly takes a risk-based approach to cybersecurity, requiring security measures to reflect the organisation’s risks.
The key point is that risk management must connect technical vulnerabilities with business consequences and ensure that the selected measures actually reduce risk.
Cybersecurity is therefore not only about protecting information. It is also about ensuring that an organization’s physical processes can continue to function when the digital systems they depend on are disrupted.