Cyberattacks are increasingly reaching beyond traditional IT systems and into the industrial control systems and other equipment businesses depend on to operate. That makes industrial control system cybersecurity a business continuity issue, not just a technical one.
On November 2, 2026, attackers targeted refrigeration systems at three French Blood Establishment (EFS) facilities. There have been multiple published attacks recently suggesting that more and more criminal groups are going after OT and ICS systems.
Attackers manipulated temperature and defrost settings, reportedly attempting to raise them to extreme levels, including a reported setting of 110°C. That figure describes the reported attempted control change, not a confirmed temperature reached by the stored plasma.
Fortunately, monitoring systems detected the abnormal conditions, allowing personnel to intervene before blood products were lost or patients were affected.
The incident involved refrigeration equipment supplied by Coolworld, which confirmed an incident involving remote monitoring software and a third-party component. The precise intrusion method has not been publicly established.
The incident raises an important question for every business leader: Is your cybersecurity program protecting the equipment that actually keeps your business running?
TL;DR: How do you protect industrial control systems?
An effective industrial control system (ICS) and operational technology (OT) cybersecurity program starts with verified asset visibility and business impact analysis. Organizations need clear accountability, secure network architecture, third-party risk management, vulnerability and attack-path protection, continuous monitoring, and tested incident response and recovery capabilities.
Key takeaways
- Attacks on refrigeration controls in Europe show cyber incidents can now damage physical operations, inventory, and critical services.
- You can't protect equipment you can't see. Verified, maintained asset visibility is the first step.
- Poor IT/OT segmentation, unmanaged supplier access, and unpatchable equipment create the attack paths that matter most.
- Monitoring only helps when alerts reach people who understand the equipment, backed by independent safeguards.
- Recovery is proven when critical operations safely resume, not when a backup completes.
The French blood-storage incident followed a wave of cyberattacks against refrigeration systems at European supermarkets in October and early November 2026. Attackers manipulated cooling and defrost settings, causing operational disruption and spoiled inventory.
France's cybersecurity agency, CERT-FR, issued an alert identifying compromises involving Danfoss, Copeland, and Dixell refrigeration control systems. The agency specifically warned about exposing industrial management interfaces directly to the internet.
On November 4, the European Commission, ENISA, Europol, and other authorities issued a joint warning, urging organizations to address exposed refrigeration systems.
The broader threat extends well beyond refrigeration. According to the 2026 Dragos OT Cybersecurity Year in Review, ransomware groups affected approximately 3,300 industrial organizations globally during 2025.
Cyberattacks against operational systems can interrupt manufacturing, damage inventory, disrupt logistics, threaten critical services, and cause physical harm and create safety risks.
Operational technology (OT) includes hardware and software that monitors or controls physical equipment and processes.
Industrial control systems (ICS) are a category of OT used to manage industrial operations, often through programmable logic controllers (PLCs), supervisory control systems (SCADA), sensors, and other connected equipment.
The Internet of Things (IoT) includes devices that collect, exchange, or act on information through network connections. Some IoT devices support industrial operations, while others manage facilities or business activities.
OT cybersecurity protects these environments against unauthorized access, manipulation, disruption, and unsafe operation.
Manufacturing equipment, refrigeration, building automation, medical equipment, and warehouse controls are examples of systems that may require specialized protection. Many connect to corporate networks, cloud services, or external vendors for monitoring and maintenance.
Yet organizations frequently lack complete visibility into these environments. Fortinet's 2026 State of Operational Technology and Cybersecurity Report found that only 14% of surveyed organizations reported full visibility into their OT systems.
Businesses may be protecting email, servers, and laptops while overlooking the technology responsible for generating revenue and maintaining operations.
Effective OT security combines people, processes, and technology. It must account for equipment reliability, operational continuity, and safety requirements.
The NIST Guide to Operational Technology Security (SP 800-82 Rev. 3) provides a foundation for building an OT security program. Here are seven priorities every organization should address.
Know what you have, what it does, and what happens if it stops working.
Identify connected equipment, controllers, sensors, software, and vendor-managed systems. Document ownership, connections, and the business processes each supports.
Validate your inventory through appropriate discovery technologies, network visibility, physical walkthroughs, and discussions with equipment operators. CISA's OT asset inventory guidance for owners and operators offers a practical reference for building that inventory.
Asset visibility must also be maintained. Organizations need to recognize when equipment, connections, or configurations change.
Understand dependencies between systems, including supporting infrastructure, applications, data, and external services. Prioritize equipment according to its impact on revenue, production, safety, and continuity.
A structured asset visibility and exposure management program helps uncover equipment, connections, and dependencies that may otherwise remain unknown.
Make OT cybersecurity a shared responsibility across IT, security, operations, and facilities.
Define who owns equipment, approves changes, manages vendors, and responds to incidents. Establish documented responsibilities, escalation procedures, and regular reviews.
Ensure security teams understand which operational personnel or equipment specialists must be involved when problems occur.
Without clear accountability, equipment can operate for years without anyone appropriately managing its cybersecurity risks.
Understand how attackers could reach your critical equipment, then restrict those pathways.
Separate OT networks from corporate IT and limit unnecessary connections to the internet. Use firewalls, secured management pathways, and controlled communications between systems.
Map potential attack paths, including connections through business applications, external vendors, remote access services, and supporting infrastructure.
An attacker who compromises a business system should not automatically gain access to manufacturing equipment or other critical operations.
In its 2026 research, Dragos identified poor IT/OT segmentation in 81% of the environments it assessed.
Understanding and limiting these pathways reduces opportunities for attackers to move between systems and cause operational damage.
Far too often organizations assume this segmentation exists or that systems are "air gapped." In my experience that assumption tends to be wrong and thus leaders unknowingly accept some high impact risks. Validate all assumptions, even what is documented.
Your suppliers, their products, and their cybersecurity practices can introduce risk into your operations.
Evaluate equipment manufacturers, maintenance providers, software vendors, cloud platforms, and other suppliers supporting critical systems. Your supply chain is another path to your business.
Review their security practices, product vulnerabilities, patching commitments, incident notification requirements, and operational dependencies. Understand what happens to your business if a critical supplier is compromised or cannot deliver its services.
Verify how vendors connect to your systems and require appropriate authentication, restricted permissions, and oversight.
A compromised supplier or vulnerable product can threaten operations even when your internal security controls are strong. Third-party risk management (TPRM) requires ongoing review based on each supplier's potential impact on your business. This means evaluating their business practices as much as their products, continually.
Understand which security weaknesses create operational risk and how attackers could exploit them.
Identify outdated firmware, unsupported controllers, exposed interfaces, weak credentials, and insecure configurations.
Evaluate vulnerabilities in context. Can an attacker reach the equipment? What access would they need? What business processes could be affected?
OT equipment often cannot be patched immediately without disrupting production or affecting reliability. Dragos reported that 26% of the industrial vulnerability advisories it analyzed lacked vendor-provided patches or mitigations.
When patching isn't possible, identify and protect the potential attack paths through network segmentation, restricted access, secure gateways, monitoring, and other compensating controls.
The objective is measurable risk reduction, even when the underlying vulnerability remains.
Detect unauthorized changes before they cause physical or operational damage.
OT security monitoring should identify suspicious network activity, unauthorized access, equipment configuration changes, and abnormal behavior. Monitoring must also connect to people who understand the equipment and can respond appropriately.
Integrate relevant alerts into your OT and IoT security program and broader security operations.
Critical equipment should have appropriate independent alarms or safety controls that remain effective if its primary control systems are compromised.
The November 2026 attack against French blood-storage refrigeration demonstrates the value of this capability. Monitoring and personnel intervention prevented the attempted manipulation from destroying blood products.
Prepare for business disruption, not simply a cybersecurity incident.
Document procedures for safely isolating compromised equipment, containing incidents, restoring trusted configurations, and restarting operations.
Identify alternate equipment, manual procedures, emergency contacts, critical dependencies, and necessary backups. Define responsibilities across cybersecurity, IT, operations, facilities, and external providers.
Test realistic scenarios to verify that these teams can coordinate effectively.
A successful backup does not prove that equipment or operations can be recovered. Recovery succeeds when critical business functions can safely resume. This should go beyond technical systems as well, ensure operations, legal, PR, and anyone else necessary are involved. Having the ability to "turn things back on" is not the same as doing it.
You don't need to replace every aging controller or purchase an entirely new security platform to begin reducing OT risk.
Start by identifying the equipment your business depends on, understanding its connections, and evaluating the consequences of disruption. The framework below shows how that process fits together, from gathering what exists to managing it over time.
Then validate what you believe you know.
Two people agreeing in a conference room that everything is accounted for doesn't establish that it actually is. Use technical discovery, physical inspections, configuration reviews, and operational evidence to verify your environment.
Consider bringing in an independent set of eyes. Internal teams become accustomed to the equipment, workarounds, and risks they encounter every day. Over time, familiar conditions can become invisible.
An independent assessment can challenge assumptions, uncover hidden dependencies, and identify exposures your team may have overlooked. They will think like an attacker, not like an employee - this is critical.
Use verified findings to build a prioritized protection plan with clear accountability, practical controls, and ongoing monitoring.
Knowing what good OT cybersecurity looks like is one thing. Knowing whether your organization has those protections in place is another.
Free download: OT, ICS & IoT Cybersecurity Risk & Readiness Self-Assessment
We created this leadership working guide to help business, operations, and cybersecurity leaders evaluate their current preparedness. This 20-minute initial assessment helps you:
You can assess your entire organization or focus on one facility, department, production line, or critical business process. Verifying findings may require additional time.
Download the free OT/ICS/IoT Risk & Readiness Self-Assessment →
Start with what you know. Find out what you can prove.
If your assessment revealed unknown equipment, unclear access paths, vulnerable systems, or recovery capabilities you can't verify, those findings deserve attention.
viLogics helps organizations discover IT, OT, ICS, and IoT assets, identify critical business dependencies, evaluate vulnerabilities and attack paths, and develop practical protection plans.
Our Asset Visibility & Discovery engagements provide an independent assessment of your environment.
Our OT and IoT Security Services help organizations establish appropriate protections, while Managed Cybersecurity Services provide ongoing monitoring, response, and risk management.
Your cybersecurity program should protect the operations that generate revenue, serve clients, and keep your business running.
Start the conversation with our OT cybersecurity advisory team.