Do you know what is connected to your network?

Summary

What happened to the supermarkets?

On the night of 11 October, attackers took over the refrigeration in hundreds of French supermarkets. Fridges and freezers were forced into defrost or set as high as 50°C, and some stores had fires [2]. France's finance minister put the number affected at about 700 of the country's 10,000 or so [1]. A second wave on 2 November hit more than 100 shops in Belgium, Sweden, Ireland, Estonia and elsewhere [3]. In the UK, a few meat suppliers had units warm up overnight. The National Cyber Security Centre (NCSC) described the UK impact as minimal and confirmed it had alerted "handfuls of organisations" with exposed technology [4].

Nobody has confirmed how the attackers got in, or who they are [1]. What experts have described is ordinary. The controllers were reachable from the internet, often managed remotely by third parties, short of updates and protected by "easily guessable" passwords. Many were past their end of life [3]. One affected model had been phased out in 2016 [15]. No new malware was needed. The intruders used the equipment's own buttons.

What is connected in a typical office?

More than most boards think. Operational technology (OT) controls physical processes such as heating, cooling, doors and lifts. The Internet of Things (IoT) is the wider family of connected devices. In a firm of 20 or 2,000 people, the list usually includes:

• Security: CCTV cameras and recorders, door access controllers, intruder and fire alarm panels that report to a monitoring centre.
• Premises: heating, ventilation and air conditioning (HVAC), the building management system, comms room cooling, lighting controls, lifts and power backup.
• Office: printers, meeting room screens and video bars, smart TVs, visitor sign-in tablets and wireless presentation boxes.
• Everything else: smart plugs, speakers, coffee machines, staff kitchen fridges and electric vehicle chargers in the car park.

The NCSC warned in 2022 that many of these devices can be reached from the internet, that security is "often an afterthought", and that once compromised they are likely to be used as a pivot point into the corporate network [5].

Why is this an attack surface, not just a gadget list?

Each device is a small computer with its own software, accounts and network connection. Four patterns turn that into risk.

1. They sit on the same network as your data

The quickest installation is to plug the camera recorder or door controller into the nearest wall socket. That puts it alongside staff laptops and file servers. The best-known example is Target in 2013. Attackers used a login stolen from its heating and refrigeration contractor, which had access to monitor store temperatures. From there they reached the payment systems and stole data on about 40 million cards. Commentators at the time called it a basic network segmentation error [6].

2. The supplier holds the keys

Installers set up remote access so they can support the kit without a site visit, often with their own accounts. Cloud-managed platforms move that control to the vendor. In 2021, a group got into Verkada, a camera company, using an administrator login it said it found exposed online. It then viewed feeds from more than 150,000 devices in hospitals, schools, factories and offices [7]. The intruders never touched those customers' own networks. They went through the supplier.

3. Nobody updates them

Laptops get updates every month. CCTV, door controllers and building systems often get none after installation. One camera maker fixed a critical flaw in September 2021. By August 2022, about 80,000 of its internet-facing devices were still vulnerable, and the weakness had been used by botnets and listed by United States authorities as actively exploited [8].

4. Nobody owns them

Facilities bought them, a contractor maintains them and the landlord may run some of them. IT may not know they exist. So nobody checks the passwords, the updates or who still has access after an engineer leaves.

Is there a rule that covers this?

Not directly, and that is part of the problem. Since 29 April 2024, UK law has banned universal default passwords on consumer connectable products, and required makers to publish how long they will provide security updates [10]. Those rules do not reach business equipment. The government's response on enterprise connected devices, published this spring, is still exploring codes of practice and regulation [11]. Until then, the camera a household buys online may be better protected by law than the access control system in your reception.

Cyber Essentials does help. Its requirements bring into scope any device that accepts connections from the internet, and they require default passwords to be changed. Unsupported software must be removed, or placed in an isolated segment with no online traffic. A sub-set of the network kept apart by a firewall or virtual LAN (VLAN) can also be excluded, with justification [9]. In practice, moving connected devices away from staff systems is good security, and can keep certification achievable.

What should firms have done before?

• Find it. Walk the building and check the network. List every connected device, who supplied it, who maintains it and when support ends.
• Separate it. Put building, security and office devices on their own network, kept apart from staff computers and client data by a firewall, with only the connections they need allowed. This is called segmentation.
• Take it off the internet. No management screen should be reachable from outside. The United States Cybersecurity and Infrastructure Security Agency (CISA) gives this advice for control systems [13], and the NCSC's connectivity principles set out how remote access should be limited and supervised [12].
• Own the logins. Change every default password. Use named accounts with multi-factor authentication (MFA) on cloud portals, and remove the installer's credentials once the job is done.
• Set the supplier's terms. Route their access through a gateway the firm controls, switch it on only when needed, and write it into the contract.
• Plan for the end. When a device loses support, replace it or isolate it completely.

Speed matters more than it did. After the French attacks, researchers used an artificial intelligence (AI) coding assistant to rebuild a working takeover of a current refrigeration controller from public information in about 28 minutes. The fixes had been available for more than a year [14]. A device that is on the internet and behind on updates should be treated as already found.

And if something is tampered with?

1. Make it safe: disconnect the device or its network segment from the internet and run it locally or manually.
2. Keep the evidence: record settings, logs and accounts before anything is reset.
3. Rebuild it properly: France's emergency response team (CERT-FR) set out the order for the refrigeration controllers: limit access, factory reset, apply all fixes, change every password, check accounts, fully reconfigure [15].
4. Check what else it could reach: if the device shared a network with laptops or servers, treat this as a possible wider breach, not a broken gadget.
5. Tell the right people: your insurer, the NCSC [16], and Report Fraud or Police Scotland [17].

What we see in practice

None of this is theory. Three examples from our own work, with the details kept general.

The door that stopped nobody

One organisation had an old building access system that was easy to bypass. It was treated as a facilities asset that opened doors, not as a security control. The result was a series of people found in areas they should never have been able to reach.

The boardroom nobody locked

At another, the chief executive did not want to be bothered with an access card. So the leadership suite and the boardrooms were left unlocked. That only changed when people were found sleeping in them at weekends. The protection was installed and paid for. It was switched off for convenience at the top, the same pattern we describe in our case study Simpler and stronger.

One password for every camera

A bank paid a third party to monitor the CCTV in all its branches. Every camera shared one username and password, which never expired. A single leaked or guessed login would have opened the whole estate, the same kind of failure that exposed 150,000 Verkada devices [7]. Watch the watcher: the supplier keeping an eye on the sites also held the only key to every one of them.

None of these needed a clever attacker. Each was a connected or physical security system chosen for ease, owned by nobody at board level and left as installed. Seniority, convenience and supplier arrangements are where controls quietly stop working.

Three questions for your next board meeting

1. What is connected? Can we name every device on our network and in our buildings that is not a managed laptop, phone or server, and is that record up to date?
2. Who has access? Which suppliers can reach those devices remotely, with whose accounts, and who at the firm can switch that off tonight?
3. Who has control? Are those devices kept apart from staff computers and client data, and would anyone at the firm know if a setting changed at 2am?

Conclusion

The supermarket attacks made the risk visible because the harm was physical. In most offices the same devices would do quieter damage: a camera feed watched, a door left unlocked, or a silent route from the building system to the file server. None of the fixes requires new technology. They need a list, a separate network, accounts the firm owns and suppliers held to a contract. Our Top 10 Actions turn that into a checklist the board can track, and our Good Practice Guide shows how to do it.

Glossary

Table 1. Terms used on this page (alphabetical).

Further reading

From CyberCQR

• Connected devices in the office: ten actions for boards
• Securing connected devices in the office: a good practice guide
• Third-party and supply chain ransomware
• Document library: every paper and tool

External

• NCSC: Organisational use of enterprise connected devices [5]
• NCSC: Secure connectivity principles for operational technology [12]

References

1. [1]Newsweek, Cyberattacks target French blood banks after supermarkets hit, November 2026.
   https://www.newsweek.com/cyberattacks-target-french-blood-banks-refrigeration-supermarkets-12661343
2. [2]Al Jazeera, Hundreds of supermarkets in France hit by "unprecedented" cyberattack, 13 October 2026.
   https://www.aljazeera.com/news/2026/10/13/unprecedented-cyberattack-hits-french-supermarkets-causing-food-losses
3. [3]Al Jazeera, with Reuters, Very cold war: who's attacking Europe's supermarket freezers?, 3 November 2026.
   https://www.aljazeera.com/news/2026/11/3/very-cold-war-whos-attacking-europes-supermarket-freezers
4. [4]ITV News, UK meat processing firms hit amid fridge and freezer cyber attacks, 3 November 2026.
   https://www.itv.com/news/2026-11-03/uk-meat-processing-firms-hit-amid-fridge-and-freezer-cyber-attacks
5. [5]National Cyber Security Centre, Organisational use of enterprise connected devices, 10 May 2022.
   https://www.ncsc.gov.uk/report/organisational-use-of-enterprise-connected-devices
6. [6]Computerworld, Target breach happened because of a basic network segmentation error, February 2014.
   https://www.computerworld.com/article/2487425/cybercrime-hacking/target-breach-happened-because-of-a-basic-network-segmentation-error.html
7. [7]CBS News, Hack of video security company Verkada exposes footage from 150,000 connected cameras, 10 March 2021.
   https://www.cbsnews.com/news/verkada-hack-tesla-nissan-equinox-cloudflare/
8. [8]BleepingComputer, Over 80,000 exploitable Hikvision cameras exposed online, 22 August 2022.
   https://www.bleepingcomputer.com/news/security/over-80-000-exploitable-hikvision-cameras-exposed-online/
9. [9]National Cyber Security Centre, Cyber Essentials: requirements for IT infrastructure, v3.3, April 2026.
   https://www.ncsc.gov.uk/sites/default/files/2026-08/IT%20Requirements%20v3.3.pdf
10. [10]GOV.UK, Regulations: consumer connectable product security, updated 17 March 2025.
    https://www.gov.uk/guidance/regulations-consumer-connectable-product-security
11. [11]GOV.UK, Government response to the call for views on enterprise connected device security, 8 April 2026.
    https://www.gov.uk/government/calls-for-evidence/call-for-views-on-enterprise-connected-device-security/outcome/government-response-to-the-call-for-views-on-enterprise-connected-device-security
12. [12]National Cyber Security Centre, Secure connectivity principles for operational technology (OT), viewed 4 November 2026.
    https://www.ncsc.gov.uk/collection/operational-technology/secure-connectivity
13. [13]Cybersecurity and Infrastructure Security Agency, ICS advisory ICSA-25-140-03: Danfoss AK-SM 8xxA series, 20 May 2025.
    https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-03
14. [14]ActuIA, Danfoss: Claroty reproduit avec l'IA l'exploit de failles connues en 28 minutes pour environ 6 dollars (in French), October 2026.
    https://www.actuia.com/actualite/danfoss-claroty-reproduit-avec-lia-lexploit-de-failles-connues-en-28-minutes-pour-environ-6-dollars/
15. [15]The Hacker News, Attackers heat French supermarket fridges up to 50°C by hijacking Danfoss controllers, 13 October 2026.
    https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html
16. [16]National Cyber Security Centre, Report a cyber incident, viewed 4 November 2026.
    https://report.ncsc.gov.uk/
17. [17]Report Fraud, Report Fraud service goes live, 4 December 2025.
    https://www.reportfraud.police.uk/news/report-fraud-service-goes-live/