Cyberattacks Shift From Data Theft to Disrupting Physical Operations

A new wave of cyberattacks targeting operational technology (OT) systems is causing significant disruption across Europe, moving beyond traditional data theft to directly impacting physical infrastructure. Recent incidents include attacks on refrigeration systems in supermarkets across France, Belgium, Sweden, and Ireland, leading to spoiled goods and millions of euros in economic damage. In one case, temperatures in affected systems reportedly reached 50 degrees Celsius. On November 2, a similar intrusion was detected in the cooling systems of three national blood service storage facilities in France. Fortunately, early warning systems allowed for the transfer of blood products to alternative locations, preventing loss.

These events highlight a growing strategic vulnerability: the world's increasing reliance on digital systems for physical operations. Experts note that cybersecurity defenses have often lagged behind, focusing on preventing data breaches and ransomware rather than safeguarding systems that control physical processes. Attackers no longer need to steal information; they can cause dramatic damage by manipulating systems that manage refrigerators, access control, medical equipment, or manufacturing lines.

The risk is amplified as many of these systems are networked, remotely managed by third-party vendors, and often built on outdated technology with default passwords or unpatched components. These systems may not always be under the purview of traditional IT security departments, making them prime targets. An attack on a single vendor can affect numerous clients, creating a single point of failure with widespread potential damage.

For Israel, a nation with critical infrastructure operating in a complex security environment and high dependence on digital systems, the implications are particularly significant. Hospitals, water facilities, food companies, logistics centers, factories, and even office buildings rely on connected systems that could become targets, regardless of whether they hold sensitive data. Ron Reinfeld, CEO of Morphisec, emphasizes the need for a shift in cybersecurity strategy.

Reinfeld suggests organizations must first map all connected assets, including operational systems and devices not traditionally considered IT assets. Second, direct internet exposure should be reduced, default passwords eliminated, updates prioritized, and remote vendor access strictly managed. Third, a move towards real-time behavioral analysis is crucial, monitoring not just what software runs but what it does and to which resources it accesses. Most importantly, he stresses a conceptual shift for security leaders and management to consider the consequences of operational systems failing, not just data being stolen, and to plan for backup, manual operation, and vendor resilience.