For years, organisational cyber security strategies have focused predominantly on prevention: Keep attackers out, secure accounts, deploy antivirus software, strengthen passwords and train employees to recognise phishing emails.
But recent attacks on supermarkets across Europe demonstrate how a cyber incident can quickly become a real-world operational problem.
Hundreds of supermarkets in France and wider European nations were affected after attackers compromised connected refrigeration systems and manipulated their controls. Refrigeration temperatures reportedly reached as high as 50°C, forcing retailers to dispose of fresh and frozen stock. Retailers including Intermarché, Carrefour and Monoprix were among those affected.
Similar incidents have subsequently been reported elsewhere in Europe, highlighting the potential exposure created as more operational equipment, from refrigeration and heating to security systems, becomes connected and remotely managed.
For businesses, the lesson extends far beyond supermarkets. A successful cyber attack does not necessarily have to steal sensitive information to cause significant damage. Compromising the technology that controls physical operations can interrupt services, destroy stock, damage equipment and potentially create safety risks.
That makes detecting suspicious activity as early as possible increasingly important.
This is where Managed Detection and Response (MDR) has an important role to play.
Prevention Cannot Cover Every Eventuality
Preventative security remains essential. Firewalls, endpoint protection, multi-factor authentication, vulnerability management and regular patching all reduce the opportunities available to attackers.
But connected operational technology can create a much broader attack surface.
In the French supermarket incidents, attackers targeted the industrial controllers responsible for monitoring and managing refrigeration equipment. Reporting indicates that some affected systems were running outdated software, while thousands of refrigeration controllers could be reachable from the public internet. The precise method used to gain access has not been publicly confirmed.
That distinction matters. Organisations cannot assume that because their core IT environment is protected, every system connected to their operations is equally secure. Legacy technology, connected equipment, remote management systems and third-party infrastructure can all introduce additional points of exposure.
The objective therefore cannot simply be to prevent every possible attack. Businesses also need the capability to identify unusual activity quickly, understand what is happening and respond before a compromise develops into a serious operational incident.
MDR strengthens that capability through continuous security monitoring, threat detection, investigation and response. Rather than relying exclusively on preventative controls, it gives organisations the expertise and visibility needed to identify threats that have made it past them.
The supermarket attacks provide a particularly tangible reminder of why that matters: when digital systems control physical operations, a cyber incident can very quickly become a business continuity incident.
The Question Becomes: Would You Spot It?
The supermarket attacks raise an important question for any organisation with connected technology: if someone gained access to a critical system, how quickly would you know?
An attacker does not necessarily need to immediately disable a system or deploy ransomware. They might begin by probing devices, changing configurations, accessing systems at unusual times or attempting to move between different parts of the environment.
Individually, some of these activities may not immediately appear to be a major cyber attack. Together, however, they can indicate that something is seriously wrong.
The French supermarket attacks demonstrate the potential consequences when suspicious activity affects operational technology. Attackers were reportedly able to manipulate refrigeration controls, with temperatures reaching as high as 50°C in some stores. The result was spoiled stock, disrupted operations and significant financial losses.
Modern security platforms such as Microsoft Defender are designed to bring security signals together across identities, endpoints, email, applications and other parts of the Microsoft environment. This gives organisations greater visibility of activity that could indicate compromise.
But technology is only part of the equation.
Alerts need monitoring. Suspicious events need investigating. Different signals need correlating. And when a genuine threat is identified, somebody needs to respond quickly.
That is the gap Managed Detection and Response is designed to address.
From Security Alerts To Security Response
Managed Detection and Response combines security technology with ongoing human monitoring, threat investigation and response expertise.
Rather than relying on somebody within the business noticing an alert during working hours, MDR provides continuous oversight of what is happening across the environment.
For organisations without their own Security Operations Centre, this can be particularly valuable. Building an internal 24/7 security capability requires much more than purchasing software. It requires experienced security analysts, established investigation processes, threat intelligence and a clear plan for responding when malicious activity is identified.
MDR gives organisations access to this capability as a managed service.
Importantly, the objective is not simply to produce more security alerts. Most organisations already have plenty of security notifications.
The value is in understanding which signals matter, investigating them quickly and taking action before suspicious activity becomes operational disruption.
Detection Speed Matters
The supermarket incidents provide a particularly clear demonstration of why speed matters. A compromised system might initially represent a security issue. But once an attacker can manipulate the technology supporting physical operations, the consequences can escalate quickly.
In the French attacks, manipulated refrigeration controls reportedly caused temperatures to rise dramatically over a period of hours, leaving supermarkets with large quantities of stock that could no longer safely be sold.
The principle applies far beyond retail. A manufacturer might rely on connected production equipment. A logistics business may depend on warehouse and tracking systems. A professional services firm may depend on Microsoft 365 and cloud applications. A facilities management organisation might have connected building, security and environmental controls.
The technology is different, but the security requirement is similar: Identify suspicious activity, investigate it and respond before a cyber incident has the opportunity to become a major business incident.
Moving Beyond A Prevention-Only Security Strategy
None of this means businesses should move away from preventative cyber security.
Strong identity protection, MFA, endpoint security, vulnerability management, patching, access controls and employee awareness remain essential. Solutions such as Microsoft Defender can also provide crucial visibility across the Microsoft security environment.
But prevention needs to form part of a wider strategy.
As organisations connect more devices, platforms and operational systems, they also increase the number of areas that potentially need protecting and monitoring.
That means businesses should be asking more operational questions:
- Who is monitoring our environment for suspicious activity?
- How quickly would an alert be investigated?
- Would unusual activity across different systems be connected?
- And if an attacker gained access overnight or at the weekend, who would respond?
For organisations without an internal 24/7 security operations function, the answers can reveal a significant gap.
Managed Detection and Response helps close it.
At Akita, we help organisations strengthen their security environments and put the monitoring and response capabilities around them. Our MDR services combine security technology with specialist expertise to identify potential threats, investigate suspicious activity and support rapid response when it matters.
The supermarket attacks are a useful reminder that cyber security is no longer simply an IT concern. When technology underpins day-to-day operations, a cyber incident can quickly become an operational, financial and business continuity issue.
The aim is not only to make it difficult for attackers to get in. It is to spot suspicious activity early and be ready to act before significant damage is done.
Speak to Akita about strengthening your cyber security with Managed Detection and Response:
Contact Us