A few keystrokes can be enough to destroy an entire stock of goods. Cyberattacks targeting refrigeration and freezer systems have affected hundreds of stores across Europe, and now a Norwegian retailer has experienced a similar incident. It shows just how vulnerable operational technology can be when systems are not properly secured.
During the night of Tuesday, 3 November, the Havaristen store in Ytre Enebakk was hit by a serious incident. The temperature in a freezer system was turned up, the sprinkler system was activated and large quantities of food were destroyed. The incident has been reported to the police and is being investigated as a possible cyberattack.
Around the same time, Swedish stores, including ICA and Coop, were hit by cyberattacks targeting refrigeration and freezer systems. In some stores, temperatures were raised to nearly 50 degrees Celsius. The incidents are part of a wider wave of attacks and problems affecting refrigeration systems in European grocery stores.
Major consequences
For NORDSEC, which brings together companies and professional communities within defence, security and preparedness, the incidents demonstrate the importance of protecting the digital systems that control physical functions.
“When a cyberattack can take refrigeration systems out of operation, it is easy to imagine the consequences if someone gains access to systems controlling industry, energy supply or other critical infrastructure. These are issues we take seriously in NORDSEC,” says Tevje Ravn Eggan, Cluster Manager at NORDSEC, and continues:
“That is why we bring companies and security experts together to share knowledge, identify vulnerabilities and strengthen preparedness. Cooperation with specialist environments such as Sopra Steria is important for making the threats tangible and showing how they can be addressed in practice.”
Kent-Åge Stallvik, Head of Governance, Risk and Compliance (GRC) at Sopra Steria, shares the concern.
“What is most worrying is the scale of the consequences when even basic security measures are missing. We are no longer talking only about stolen data or systems going offline. A digital attack can destroy goods, halt production and, in the worst case, put lives and health at risk,” says Stallvik.
Kent-Åge Stallvik, Head of Governance, Risk and Compliance (GRC) at Sopra Steria. Photo: Lars Bugge Aarset/Fremtidens Industri
Demonstrated the vulnerability one year ago
As early as autumn 2025, NORDSEC put this issue on the agenda. Together with Sopra Steria, the defence and security cluster brought member companies together for an event focusing on how physical infrastructure can be protected against digital threats.
During the event, Andreas Asbølmo from Sopra Steria demonstrated how vulnerabilities in digital control systems can be exploited, and how inadequate security can give unauthorised users access to technology controlling physical functions.
This type of technology is known as operational technology (OT) and is found in far more places than many people realise. It controls everything from ventilation and access control to refrigeration systems, production lines and critical infrastructure.
“Many people still think of cybersecurity as protecting computers, email and information. But more and more of the physical world is connected to the internet. That means we also need to think differently about what actually needs to be protected,” says Ravn Eggan.
Tevje Ravn Eggan er klyngeleder i NORDESC. Foto: Lars Bugge Aarset/Fremtidens Industri
The easiest way in can cause the greatest damage
According to Sopra Steria, the greatest risk often does not come from sophisticated attack methods. Old systems, default passwords, poorly secured remote access and a lack of oversight of connected equipment may be all an attacker needs.
At Havaristen, the affected freezer room was connected to an external 4G transmitter that allowed the supplier to control the system remotely. The rest of the refrigeration and freezer equipment was connected to a separate system behind the company's own firewall. The store says it was not aware that the transmitter in question was unsecured. It has not yet been confirmed how an unauthorised party may have gained access to the system. [https://ww...1.18072469]
"Digitalisation makes operations and maintenance easier, but it also creates new entry points for attackers. The problem arises when we connect more and more equipment to the internet without having sufficient control over who has access and how these systems are secured," says Stallvik of Sopra Steria.
.jpg?width=6000&height=4000&name=Sikkerhetskurs%20NORDSEC%20Foto%20Lars%20Bugge%20Aarset%20(56).jpg)
Andreas Asbølmo from Sopra Steria demonstrates how vulnerabilities in digital control systems can be exploited. Photo: Lars Bugge Aarset/Fremtidens Industri
NSM warns: Cyber risk is high
On 27 October, the Norwegian National Security Authority (NSM) raised the national cyber risk level to high. Among the reasons was a threefold increase in successful cyber operations against Norwegian organisations over the previous six months.
NSM is urging organisations to implement preventive measures immediately. Stallvik believes the warning must be taken seriously beyond IT departments as well.
"This is a management responsibility. Leaders do not need to understand in detail how a refrigeration system works, but they do need to know which systems the organisation depends on, what the consequences would be if those systems were compromised, and who is responsible for securing them"
.jpg?width=6000&height=4000&name=Sikkerhetskurs%20NORDSEC%20Foto%20Lars%20Bugge%20Aarset%20(71).jpg)
Photo: Lars Bugge Aarset/Fremtidens Industri
Three steps companies should take now
Sopra Steria recommends that companies start by establishing an overview of which systems and devices are connected to the internet, who has access to them and who is responsible for their security. The next step is to close the easiest routes in. Default passwords should be changed, remote access secured and access to critical systems restricted.
Just as important is being prepared for something to actually happen. Companies should know how to respond if a digital attack affects physical operations, and employees, suppliers and management must understand their respective roles.
“We do not need to make this more complicated than necessary. Start by finding out what is connected to the internet, who can get in, and what the consequences would be if someone took control. These are questions every company should be able to answer,” says Stallvik.
The need for greater knowledge about these threats means that NORDSEC will now follow up its security work with member companies.
“Recent developments show that the need for training and awareness has certainly not diminished. That is why NORDSEC is planning a new series of security courses for companies in 2027,” says Ravn Eggan.