More than 100 European stores have been affected by attacks on refrigeration systems, following a similar incident in France just weeks earlier. For security leaders, the incidents highlight the operational and financial consequences of third-party cyber risk in connected systems and supplier environments.
The supermarket cyberattack that turned up the heat across Europe
In early November, supermarkets across Europe faced a costly disruption. Refrigeration systems in more than 100 stores across Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands, and Sweden were reportedly manipulated by attackers, forcing freezers and refrigerators into defrost mode. Some units reached temperatures as high as 50°C.
The consequences were immediate. Food spoiled, stores faced operational disruption, and retailers were left dealing with significant financial losses. One Belgian supermarket reportedly estimated its losses at €100,000 in spoiled inventory alone.
This was not an isolated incident. Just weeks earlier, on October 11 and 12, a similar attack affected hundreds of supermarkets across France. Retailers including Intermarché, Carrefour, Coopérative U, and Monoprix reported refrigeration disruptions. Some stores had to discard fresh and frozen products, while others experienced equipment damage.
The French incidents exposed vulnerabilities in connected refrigeration controllers, including controllers with known security flaws that had not been updated. The latest European attacks appear to follow a similar pattern, although investigators have not established whether the incidents are connected or who is responsible.
The concerns extend beyond Europe. Separately, the Pentagon investigated suspected cyberattacks following freezer malfunctions at approximately six US military commissaries in August. Investigators had not confirmed the cause or identified those responsible.
For CISOs and security managers, these incidents raise a familiar but difficult question: how much control do you really have over the technology and external providers your business depends on?
Connected operational technology, outsourced services, and supplier-managed systems can all introduce exposure beyond an organization’s own network. When those systems are compromised, the impact can reach business operations, customers, and revenue, even when the organization itself has not been breached.
The security perimeter extends beyond the systems an organization owns and manages.
For more on the earlier French incident, read The French Supermarket Cyberattack: Third-Party Risk in the Freezer Aisle.
The financial impact of third-party cyberattacks goes beyond the initial breach
The freezer attacks offer a clear example of how a cyber incident can become an operational and financial crisis.
For a supermarket, the immediate damage may be spoiled inventory. But the wider impact can include store closures, equipment replacement, disrupted deliveries, incident investigation, and recovery costs. In France, one supermarket owner reported losing approximately €21,000 in stock at a single location. In Belgium, one retailer estimated losses of €100,000.
For organizations operating across multiple locations, even a short disruption can have a significant financial impact. And when an incident affects several businesses or suppliers, the consequences can multiply.
The same risk applies across industries. A compromised technology provider, logistics company, cloud platform, or equipment manufacturer can interrupt the operations of every business that relies on its services.
For security leaders, this creates a challenge that goes beyond identifying technical vulnerabilities. It requires understanding the business consequences of supplier exposure and being able to communicate those consequences to executive leadership.
The costs may include:
- Operational disruption: Interrupted production, logistics, and customer-facing services.
- Direct financial losses: Lost revenue, damaged inventory, recovery expenses, and emergency replacements.
- Regulatory and legal exposure: Reporting obligations, contractual disputes, investigations, and potential penalties.
- Reputational damage: Reduced customer and partner confidence.
- Long-term recovery: Rebuilding systems, investigating incidents, and restoring operations.
A supplier’s security weakness can become your organization’s business problem. That makes supplier criticality, operational dependencies, and potential financial exposure essential inputs to cyber risk decisions.
Why third-party cyber risk is becoming harder to manage
The freezer attacks highlight a challenge that security teams increasingly face: managing risk across technology and supplier environments they do not directly control.
Supplier ecosystems now extend well beyond traditional IT vendors. They include connected equipment, software platforms, maintenance providers, cloud services, and subcontractors. Some support essential business processes, while others provide services that are difficult to replace quickly.
The French incidents illustrate what can happen when connected operational technology is not adequately secured or maintained. Unsupported firmware and outdated systems can remain in use long after their security risks become clear. For security teams, identifying these dependencies and establishing who is responsible for maintaining them can be difficult, particularly when multiple providers are involved.
This is not limited to retail. Manufacturers depend on external providers to manage production equipment. Hospitals rely on connected systems to monitor medication storage. Logistics companies depend on third-party technology to manage warehouses and distribution.
In each case, a vulnerability in an external environment can create operational exposure for the organization relying on it.
Artificial intelligence adds another dimension to this challenge. There is no established evidence that AI was used in the freezer attacks, but its growing role in cyber operations is changing the speed and scale of existing threats.
For security teams, four developments deserve attention:
1. Faster vulnerability discovery
AI can help analyze large volumes of information, identify exposed systems, and uncover weaknesses across digital environments, including those belonging to suppliers.
2. Greater scale across connected environments
Automated reconnaissance can help attackers identify potential targets and map relationships across interconnected systems and supplier networks.
3. More pressure on patching and remediation
As vulnerability research and exploit development accelerate, organizations have less room to rely on slow patching cycles or suppliers with limited security resources. Legacy and unsupported systems become particularly difficult to manage.
4. More convincing social engineering
AI-generated messages, impersonations, and phishing campaigns can make it harder to distinguish legitimate supplier communications from malicious activity, increasing the risk of compromised credentials and unauthorized access.
At the same time, organizations are adopting more AI-powered tools and services, introducing new providers, data flows, and dependencies into their environments.
The result is a broader risk management challenge: security teams must account for both the changing capabilities of attackers and the expanding network of external services their organizations rely on.
For a deeper look at how AI is changing third-party risk, explore The CISO’s Guide to Safe AI in TPRM.
Seeing beyond your immediate suppliers: fourth- and Nth-party risk
For security leaders, the question is not simply whether suppliers meet a defined security standard. It is whether the organization understands the exposure those suppliers introduce, how that exposure affects business operations, and what needs to happen when a risk is identified.
Traditional vendor assessments, security ratings, and periodic questionnaires remain useful sources of information. But on their own, they may not provide enough context to support risk-based decisions.
Two suppliers can have similar external security ratings but present very different levels of business risk. One may handle sensitive customer data or support a critical business process. The other may provide a service that can be replaced with little disruption.
The same applies to fourth- and Nth-party relationships. A critical supplier may rely on external technology providers or subcontractors that introduce additional dependencies, often outside the direct view of the organization.
A mature third-party cyber risk program needs to help answer several questions:
- Which suppliers support critical business services or hold sensitive data?
- Where do fourth- and Nth-party dependencies introduce additional exposure?
- Are identified security gaps being addressed, and can remediation progress be verified?
- How quickly can changes in a supplier’s security posture be identified and assessed?
- What would the operational and financial consequences be if a critical supplier were compromised or unavailable?
For European organizations, these questions also have regulatory implications. Frameworks such as NIS2, DORA, and the Critical Entities Resilience Directive place greater emphasis on cybersecurity, supplier dependencies, and operational resilience.
The objective is not to assess every supplier with the same level of scrutiny. It is to establish a clear view of the organization’s exposure, focus resources on the relationships that matter most, and ensure identified risks receive appropriate attention.
Panorays’ guide to building a global TPRM governance program explores how organizations can establish consistent oversight across complex supplier ecosystems.
Turning third-party risk visibility into action
A third-party risk program is only effective if it helps security teams make better decisions and drive progress. Identifying a vulnerability is one step. Understanding its business significance, engaging the supplier, and tracking remediation are what move risk management forward.
This requires a connected view of supplier security. External attack surface intelligence, questionnaire responses, supporting evidence, supplier criticality, and business context need to inform the same assessment.
Panorays brings these elements together in one unified platform. AI-powered assessments help teams analyze supplier responses and supporting evidence, identify potential gaps, and evaluate security posture. This information is considered alongside supplier criticality and business impact, helping teams prioritize based on the risk each relationship presents to the organization.
Panorays also maps fourth- and Nth-party relationships, helping security teams look beyond direct suppliers and identify dependencies that may otherwise remain outside their view. Learn more about managing third-party and Nth-party cyber risk.
Automated workflows support the assessment and remediation process, from prioritizing suppliers and managing engagement to tracking remediation plans and supplier progress through the vendor lifecycle. This helps teams manage larger supplier ecosystems without relying on manual follow-ups at every stage.
Learn how Panorays’ remediation workflows help teams prioritize supplier security gaps and track progress toward agreed security goals.
The aim is not to eliminate every third-party risk. It is to give security teams the context and processes they need to determine where risk matters most, direct attention accordingly, and maintain oversight as supplier environments change.
Your supply chain is part of your attack surface
The freezer attacks across Europe are a reminder that cyber incidents do not always take the form of data theft or network intrusion. They can disrupt physical operations, damage inventory, interrupt services, and create losses across organizations that depend on the affected systems.
The precise relationship between the October and November attacks remains under investigation. But the underlying challenge is familiar to security leaders: external technology and supplier dependencies can introduce risks that are difficult to identify, assess, and manage from within the organization’s own environment.
As supply chains become more connected, third-party cyber risk needs to be treated as part of the wider security and resilience strategy. That means looking beyond individual supplier ratings, understanding the business impact of critical dependencies, and ensuring identified risks lead to meaningful follow-up.
Because when a supplier goes down, your business may be the one paying the price.
Get a clearer view of your third-party risk
See how Panorays helps security teams assess suppliers, uncover hidden dependencies, prioritize risk, and track remediation across the supply chain. Book a personalized Panorays demo.
Frequently asked questions
What happened in the European supermarket freezer attacks?
In early November 2026, attackers reportedly manipulated refrigeration systems in supermarkets across seven European countries, switching freezers and fridges into defrost mode. Some units reached 50°C, spoiling food and disrupting stores. The attacks followed a similar incident that hit hundreds of French supermarkets on October 11 and 12.
What is third-party cyber risk?
Third-party cyber risk is the exposure an organization takes on through the suppliers, service providers, and technology it relies on. A weakness in a supplier’s systems, such as connected equipment that is not updated, can disrupt your operations even if your own network is never breached.
What are fourth- and Nth-party risks?
Fourth- and Nth-party risks come from your suppliers’ own providers and subcontractors. These dependencies are often outside an organization’s direct view, but a compromise there can still reach your business.
How can organizations reduce third-party cyber risk?
Start by identifying which suppliers support critical services or hold sensitive data. Combine external attack surface intelligence, questionnaire responses, and business context to prioritize risk. Then engage suppliers on identified gaps and track remediation until it is verified.
