By Andy Lomasky, Senior Director, IT, PMMI
When we think about cyberattacks, we often picture stolen data, ransomware demands, or compromised computer systems. But a recent series of attacks across Europe demonstrates how cybersecurity incidents can have very real-world physical consequences.
In late October and early November, cybercriminals reportedly manipulated connected refrigeration systems in supermarkets across seven European countries, causing freezers to warm up and forcing retailers to discard significant quantities of food.
For packaging and processing machinery manufacturers (and the consumer packaged goods companies they serve), this incident should serve as an important warning about the risks associated with connected industrial equipment.
What Happened?
According to BBC News, attackers reportedly manipulated refrigeration controls, including switching equipment into defrost mode, causing temperatures in some units to reach as high as 122 F (50 C).
The consequences were significant. Supermarkets discarded spoiled food, with reported losses reaching millions of euros across the incidents. Some locations temporarily closed, while equipment providers scrambled to disconnect affected systems from their networks.
Perhaps most concerning, one equipment manufacturer indicated that addressing the vulnerability would require physical modifications to the equipment, not simply software updates.
The full technical details remain under investigation, but the broader implications are clear.
What Does This Mean for Packaging and Processing?
Modern packaging and processing machinery increasingly relies on remote monitoring, cloud connectivity, programmable logic controllers, and industrial IoT devices.
These technologies offer tremendous benefits, including faster troubleshooting, predictive maintenance, and reduced downtime. But they also introduce cybersecurity risks.
Imagine an attacker gaining unauthorized access to a packaging or processing line and changing operating parameters, disrupting production, or compromising product quality.
For CPG manufacturers, the consequences could extend beyond downtime to include wasted materials, damaged products, safety concerns, and supply chain disruptions.
While the European attacks targeted refrigeration equipment, the same fundamental risks apply to any connected industrial machinery.
Securing Connected Equipment Is a Shared Responsibility
The incidents reinforce the importance of cybersecurity collaboration between equipment manufacturers and their customers.
For machinery manufacturers: Build security into equipment from the beginning. Protect remote access, avoid exposing industrial controls directly to the internet, and establish processes for communicating and addressing vulnerabilities.
For CPG manufacturers: Understand which machines are connected to your networks, control vendor access, separate operational technology from business systems where appropriate, and incorporate connected equipment into cybersecurity response plans.
Both parties also should consider what happens if connectivity must be disabled. Can equipment continue operating safely without remote access? What is your business’s continuity plan if that happens?
These precautions help ensure that the benefits of connected manufacturing don't come at the expense of operational security.
The Bottom Line
The European supermarket refrigeration attacks demonstrate that cybersecurity is no longer just about protecting data. It's about protecting the physical systems that keep manufacturing businesses operating.
As packaging and processing equipment becomes more intelligent and interconnected, cybersecurity must evolve alongside it.
For PMMI members, the lesson is simple: Cybersecurity is a product quality, operational continuity, and business resilience concern, not just an IT issue.
It's worth asking one important question:
If someone gained unauthorized remote access to our equipment tomorrow, what could they change, and would we know?
Source: James Gregory, BBC News, "Shop Freezers in Seven European Countries Hit by Cyber-Attack," November 2026.
