Another apparent security incident, this time on connected cold-storage units in Europe, serves as a critical reminder of the importance of cybersecurity, both for the target entity and the community at large.

Former government regulators on our team know what can follow for the company: Government inquiry into security posture and cyber readiness. We explain what happened in France, how regulators and investigators are likely to evaluate it, and what companies (including in the U.S.) should do now, before a regulator comes calling.

Companies can reduce the risk and impact of attacks on operational technology by understanding their connected equipment, tightening vendor access, building independent safeguards, and preparing in advance for the legal, operational, insurance, and disclosure issues that may follow an incident.

What happened

Last week, attackers raised the temperature and defrosting thresholds at three cold-storage sites operated by the French Blood Establishment (EFS) that hold plasma. According to multiple media reports, target setpoints that normally sit near -30°C (-22°F) were reportedly pushed as high as 110°C (230°F). EFS says its monitoring systems caught the change quickly, staff secured or moved the plasma in time, and no blood products or samples were lost.

The point of entry was a refrigeration equipment supplier, Coolworld, which said a vulnerable third-party component affected a limited number of its units. France's national cybersecurity agency and the Health Ministry are investigating, and no responsible party has been named.

The incident follows an early November attack on refrigeration and freezer systems at hundreds of supermarkets and independent stores in France, Belgium, and the Netherlands. Ahold Delhaize, a Dutch multinational retail and wholesale holding company, has said that attack could reduce fourth-quarter sales by up to $281 million and operating income by more than $112 million, CBS News reported.

How regulators and investigators may look at this

In the wake of the immediate response to an incident, companies also need to brace themselves for potential regulatory scrutiny. Regulator questions here may include who owned the control, what was known before the breach, and what the organization did when it learned of the failure.

• Who owned the control. The reported entry point was a vulnerable third-party component in a supplier's refrigeration units. Operational technology (OT), meaning the control systems that run physical equipment such as compressors, sensors, and thermostats, is often managed by a vendor and left outside a company's ordinary security reviews. Reviewers may ask whether the customer knew the component existed, whether the contract assigned responsibility for security updates, and whether anyone examined the supplier's access. A company that cannot answer has a governance finding before it has a technical one.
   
• Whether detection worked. The French Blood Establishment says its monitoring caught the change quickly and staff acted in time. Investigators give that fact real weight. A control that operates independently of the system it protects, with a named person responsible for responding, is the strongest evidence of a functioning program. Companies without one will be asked why.
   
• How the response was documented. After an incident, the record decides how the review goes. Regulators look for a timeline, a list of who was notified, who authorized each decision, and whether any reporting obligation was met on time. A record reconstructed after the fact reads as concealment, even when the response itself was sound.
   
• Whether the weakness repeats. Vulnerabilities and attacker focus in this area may have been known. When the same weakness appears twice, reviewers can treat the second incident as foreseeable. Any company that uses similar equipment or suppliers should expect to be measured against these events.

What companies should do with their operational technology now

• Map your equipment. In addition to focusing on traditional connected devices, businesses should identify every system that connects to a network or a vendor portal, and record who can change its settings.
   
• Review vendor access and contracts. Confirm how suppliers reach your equipment remotely, whether components receive security updates, and what each contract says about vulnerability notice, patching, and cost allocation after an incident.
   
• Set independent alarms. Temperature alerts that operate separately from the control system, with a named person responsible for responding, protect against a compromised controller reporting normal readings. Many other types of OT may have similar alarm indicators to trigger response when unusual events occur.
   
• Prepare and document the response. Plan for equipment failure and infiltration. Here, the entity could decide in advance where inventory moves if a site loses cold storage, who authorizes the move, and who notifies customers, insurers, and regulators. Depending on the sector and the contract, reporting and notice obligations may apply, and the timing is short. Keep a contemporaneous record of every decision.
   
• Involve counsel early. An internal review conducted at the direction of counsel can protect privilege while the facts are still developing. That decision is far easier to make before an incident than during one.
   
• Check insurance and disclosure. Confirm that cyber and property coverage respond to physical loss caused by a cyber event. Public companies should also consider whether a supplier-originated incident of this kind belongs in risk factor and incident disclosure analysis.

For more information, please contact us or your regular Parker Poe contact. Click here to subscribe to our latest alerts and insights.