A wave of cyberattacks disrupted supermarket refrigeration systems across Europe this week, and the researchers who looked into them say the real lesson has little to do with ransom notes or stolen data. Threat researchers at SentinelOne‘s SentinelLABS unit found that attackers got into the operational technology (OT) running the fridges and needed nothing else to cause disruption. That’s what OT cyberattacks look like now: no data theft, no ransom demand, just a cold room that stops working.

What SentinelLABS Found Behind the OT Cyberattacks

In a report titled “Defrost and Disrupt: An Assessment of Europe’s Refrigeration Attacks,” SentinelLABS examined how supermarket chains lost control of their cooling systems this week. The team’s working theory centres on two familiar weaknesses: management interfaces left exposed to the internet, and passwords that were either default or easy to guess. Neither is exotic. Both are common across industrial control systems built to be managed locally, then connected to a network without much thought for who else could reach them.

The result is a type of incident that doesn’t fit the usual cybercrime playbook. There was no ransom note, no stolen customer database, no extortion demand. The disruption itself was the damage: spoiled stock, halted operations, a logistics headache with no attacker on the other end to negotiate with.

The Third-Party Access Problem

SentinelLABS’ analysis points to a problem that goes well beyond refrigeration: how organisations manage remote access for vendors and maintenance contractors. Refrigeration units, like much industrial equipment, are often serviced remotely by third parties who need a way into the system without being on-site. That access point, if poorly secured, becomes exactly what happened in Europe this week: a door left unlocked for anyone who finds it.

Securing that access without slowing down maintenance is the harder problem. Locking vendors out entirely isn’t realistic for businesses that depend on them to keep equipment running. The more practical fix is tighter control over who can connect, when, and with what credentials, plus basic hygiene like changing default passwords and keeping management interfaces off the open internet.

Why Singapore Should Watch Critical Infrastructure Cybersecurity Closely

Singapore has reasons to pay attention to this, even though the attacks happened in Europe. Food supply resilience and increasingly connected operations are already business priorities here. SATS introduced an AI-enabled supply chain Control Tower in February 2026 specifically to anticipate and manage risks to the country’s food supply, a sign of how much of that resilience now runs through connected, software-driven systems.

Separately, the Cyber Security Agency of Singapore’s Singapore Cyber Landscape 2025/2026 flags unpatched IoT devices, default passwords and interconnected supply chains as recurring risks: the same categories of weakness SentinelLABS identified in the European refrigeration incidents. None of this means Singapore’s food supply chain has been targeted. It means the entry points exploited in Europe exist in plenty of other places too, and critical infrastructure cybersecurity in Singapore increasingly depends on treating operational technology with the same scrutiny as IT systems.

For businesses anywhere, the practical steps are straightforward: find out which systems can be reached remotely, check whether any of them still use default credentials, and treat vendor access as a security decision rather than just an operational convenience.