Are the OT Security Alarm Bells Finally Being Heard?
By: Jeroen Wijnands, Principal Consultant OT Security
HuFiCon Management Memo:
Journey with the CISO
A mountain climb to cyber security resilience. Find out how to get to the summit of cyber security resilience in Inge van der Beijl's management memo, from her presentation at the Human Firewall Conference (HuFiCon) on the 14.11.2024.
The climb will take you from the base camp of foundational security to the high-camp of a security conscious culture, all the way to the summit consisting of strategic security integration.
Inge van der Beijl
Director Innovation
How supermarket freezers are turning up the heat on lax security measures
Most CEOs and CISOs know their operational technology (OT) estate is often more vulnerable than their IT and a successful attack can do even more damage. The general public, however, has barely noticed–until now. After decades of notable cyberattacks, we may have finally reached the collective “aha” moment when public perception seismically shifts and political pressure demands meaningful action towards OT security.
Why 2026 Marks a Pivotal Year in OT Security
In October and November 2026, unnamed attackers targeted poorly secured freezer controllers at leading supermarket chains in western and northern Europe. The attacks grabbed global attention. Consumers were confronted with empty freezer shelves and photos of spoiled food being thrown away, while businesses tallied millions of euros in losses. Within 10 days of the attack in France, the head of their national cyber security agency appeared before the Senate to explain to French politicians the attack was the result of poorly secured assets with a direct internet connection.
Sound familiar? This is exactly what we heard earlier this year after US municipal water supply systems were breached by threat actors. Those of us in OT security have been warning clients for years about what can easily happen when poorly secured devices that should be behind a proper firewall are connected directly to the internet. But to know why we’ve reached this moment now, you first should have an idea of how the OT security field has developed over the past two decades.
How Significant Cyberattacks Have Shaped OT Security
The OT security sector has seen several moments that have fundamentally changed how specialists understand risk and prioritise defensive measures. At the forefront is undoubtedly the Stuxnet attack on the Iranian nuclear programme in 2010. It was the first reported case of a cyber weapon being deployed against physical infrastructure, and an air-gapped one at that.
The second was likely the container company Maersk getting hit by the NotPetya malware in 2017. Not an OT problem in itself, but for the first time it became abundantly clear that a modern enterprise with a physical process at its heart can be so disrupted that it has to recover fast or go out of business.
From mid-2017 onwards, OT security developed more quickly. Organisations became aware of real threats to their operations and CISOs started to investigate their primary production processes, often uncovering a strong dependence on outdated hardware and poorly defended networks. Over the next few years, most OT security specialists focused primarily on conducting security assessments and getting initial remediation projects off the ground.
Then, in February 2022, Russia invaded Ukraine, causing another shift in the world of OT security and geopolitics. Since the invasion, Russia has intensified its hybrid offensive against countries–mainly those in the EU–supporting Ukraine. Attacks included FrostyGoop, which targeted municipal energy systems in Ukraine, leaving thousands of people without heat during subzero temperatures. Additionally, the attack on Polish renewable energy in late 2025 provided new insight into an attack on critical national infrastructure that resulted in a significant number of OT devices becoming so corrupted they had to be replaced.
Together, these four incidents (and certainly a few others) have pushed OT security from a niche security topic toward board-level critical-infrastructure risk management.
|
Major cyber incident |
What OT security practitioners learned |
Impact on fundamental defensive controls |
|
Stuxnet (2010) |
Cyberattacks can cause covert physical sabotage |
Process integrity, PLC protection, air-gap hygiene, anomaly detection |
|
NotPetya/Maersk (2017) |
IT compromise can disrupt OT-dependent operations at scale |
Segmentation, resilience, backups, manual fallback, incident response |
|
FrostyGoop (2024) |
Municipal OT can be directly manipulated with civilian impact |
Modbus/protocol security, OT monitoring, false-data detection |
|
Poland renewable energy sector (2025) |
Distributed energy and edge devices are strategic attack surfaces |
Edge hardening, secure remote access, grid visibility, recovery planning |
OT Security’s Watershed Moment
So if the risks and defensive control measures aren’t new, why is this information suddenly making waves? It’s because awareness has now spread far beyond CEOs and CISOs. Thanks to mainstream news and political scrutiny, you don’t need to be in OT or IT to know what happened and, most importantly, why.
Moreover, these incidents have made the consequences of inattention to OT security tangible in people’s day-to-day lives. While the average person might not have a clear understanding of IT–OT convergence, they know what it means when store shelves are empty, faucets are dry, and homes are without heat in subzero temperatures. Freezers are just the tip of the iceberg. Threat actors can easily escalate and scale these kinds of attacks, even using them as a template for other forms of critical but often overlooked process automations such as irrigation computers in agriculture.
The Alarm Bells are Sounding
No matter the industry, organisations can’t afford to ignore these warning signs and hope they won’t be next. The solution is unchanged and it is simple. Stop putting OT security at the bottom of the priority list or treating it as yet another compliance exercise. Instead, focus on prevention: secure the internet connection, patch the controller, change the password.
Resilience doesn’t need a big investment; it just needs commitment.
Ready to focus on prevention? Northwave can help your organisation gain visibility into your OT risk, then implement a structured path to improvement. Contact us today to get started with an OT security assessment.
We are here for you
Need help with your cyber security or wondering how secure your business really is?
Get in touch and we will help you find the best solution.