Hacked refrigeration systems – Why IoT security is a legal and governance responsibility

Whoever makes decisions on digital security within a company also determines the continuity of the business. This applies not only to servers, financial records and customer data. Refrigeration systems, sensors and maintenance systems can also leave a company vulnerable. The attacks on supermarket refrigeration units demonstrate how a digital intrusion can directly lead to physical damage. This presents an important challenge for business leaders: to integrate cybersecurity with maintenance, supplier agreements, governance and legal compliance, before an incident forces them to do so.

On 2 November 2026, reports emerged of compromised refrigeration systems at Belgian Delhaize stores, part of Ahold Delhaize. Other supermarket chains and Dutch companies were also mentioned. French supermarkets had already been attacked in October. According to reports, the attackers altered the settings of refrigeration systems, including setting a target temperature of 50 degrees Celsius. It appears that defrost functions were exploited in the process. Heating elements that normally prevent ice build-up can cause the temperature to rise if controlled incorrectly. It should be noted that a set target temperature is not the same as the temperature actually reached. Nevertheless, the consequences were far-reaching: food was lost, business owners had to take emergency measures, and business operations came under pressure.

Where does the vulnerability lie?

The vulnerability does not necessarily lie in the fridge as a standalone appliance. It often involves a combination of control software, network connections and access for maintenance providers. Remote management saves time and enables rapid fault diagnosis. At the same time, this creates a point of access that must be carefully secured. This connected equipment forms part of the Internet of Things, or IoT. In a business environment, the IoT overlaps with operational technology: systems that control physical processes. An unauthorised user could therefore not only view data, but also alter the way installations function. Digital security therefore also encompasses the reliability of commands, settings and alarms.

What does this mean in practical terms for business owners?

A first practical question for business owners is therefore not what new legislation exists, but which digital dependencies underpin their business processes. Which devices communicate with the internet? Who can change settings remotely? How long will the software continue to be supported? And who responds if an alarm goes off in the middle of the night? An overview of equipment, software versions, suppliers and administrative access forms the basis for IoT security. Without this overview, risk analyses and contractual agreements can easily get bogged down in generalities.

Targeted measures can then follow on from this inventory. Limit external access to what is strictly necessary for maintenance and, where appropriate, separate system control from the administrative environment. Ensure that users can be identified, have appropriate access rights and that changes remain traceable. Also investigate whether critical processes require an independent alarm and a secure local fallback option. A secure internet connection is one measure, not a complete security strategy. The system must also be resilient to the misuse of a valid account and to the failure of a warning to be issued. Updates must be accompanied by a workable procedure for installation, testing and recovery, particularly where a change itself could disrupt production or service provision.

Which cyber regulations apply?

European and Dutch cyber legislation aligns with this division of risks. The Cyber Resilience Act focuses on digital products and the responsibility of parties that place them on the market. The Cyber Security Act covers the security of organisations within its legal scope. The AI Regulation becomes relevant when the application is, in fact, an AI system. In addition, the GDPR continues to apply to the processing and security of personal data. The regulations address different aspects of the same digital environment. Compliance with one regulation therefore does not automatically mean that the other has also been met.

For organisations that qualify as essential or important entities, the Cybersecurity Act provides a direct framework for managing cyber risks. This Dutch implementation of NIS2, together with the Cybersecurity Decree, has been in force since 15 August 2026. It requires technical, operational and organisational measures that are appropriate and proportionate to the risks involved. This includes the security of supplier relationships, access control, incident response, training and business continuity. It therefore concerns the organisation as a whole, not just the IT department. The board must approve the measures. Furthermore, to ensure the required managerial knowledge and skills, the Act includes a training and certification scheme with transition periods.

This makes a correct assessment of the scope of application essential. The use of a connected system does not automatically bring a company within the scope of the Cybersecurity Act. Nor does every company that sells foodstuffs fall directly under the foodstuffs category. That category covers wholesale trade and industrial production and processing; size, other activities and any designation also play a role. The position must be assessed on a case-by-case basis for each relevant entity. For foreign branches, the applicable national framework is also important. A company that is itself outside the scope of the Act may still face contractual security requirements from customers who need to protect their supply chain.

What does the Cyber Resilience Act require of manufacturers and importers?

Whereas the Cybersecurity Act focuses on the organisation, the Cyber Resilience Act shifts the focus to product security. This European Cyber Resilience Regulation covers hardware and software with digital elements whose intended or reasonably foreseeable use involves a data connection to a device or network. Indirectly connected products may also fall within its scope. A temperature controller, for example, does not need to be connected to the internet independently to be relevant to the CRA. Remote processing may form part of the product if the software in question has been developed under the manufacturer’s responsibility and the product cannot fulfil a function without that processing. This does not mean that every individual cloud service automatically falls within the scope of the regulation.

Manufacturers must prepare for security to be an integral part of the product life cycle. The broad CRA requirements include, amongst other things, risk analysis, protection against unauthorised access, the security of commands and configurations, and an effective approach to vulnerabilities. Documentation of software components, regular security tests and the secure distribution of updates support this approach. Support must be commensurate with the expected service life. It must last for at least five years, unless the product is expected to be used for a shorter period. For commercial installations with a long service life, a longer support period may therefore be required. Importers and distributors are subject to their own checks and responsibilities. Private labelling may also result in a company being treated as a manufacturer.

For planning purposes, the distinction between entry into force and application is important. The general CRA obligations apply from 11 December 2027. The provisions concerning conformity assessment bodies have applied since 11 June 2026. Manufacturers have been required to comply with reporting obligations regarding actively exploited vulnerabilities and serious incidents affecting product security since 11 September 2026. This requires an early warning to be issued without undue delay and no later than 24 hours after becoming aware of the issue, followed, in principle, by a more detailed report within 72 hours. Older products falling within the scope of the Regulation are also subject to these reporting obligations. As regards the other requirements, a transitional arrangement applies in principle to products placed on the market before 11 December 2027: these requirements become relevant if the product undergoes a significant change from that date onwards. Waiting until 2027 is therefore not possible for every obligation.

When does the AI Regulation apply to connected systems?

The use of artificial intelligence then requires a separate assessment. A digital controller is not automatically AI. In applications for fault prediction, optimisation or the autonomous execution of tasks, it must be investigated whether an AI system is involved, which risk classification applies and who fulfils which legal role. It is not yet established that AI was used in the attacks on the supermarket refrigeration systems. The link is primarily practical: both connected devices and AI can be granted capabilities that influence the physical or digital business environment.

This difference in capabilities deserves more attention than the question of how convincingly an AI application provides answers. A text assistant without access to business systems occupies a different position from an AI agent capable of operating maintenance software. Grant an active system only the necessary rights and organise supervision, alerting mechanisms and an effective means of intervention. Simply instructing the system to remain within certain limits does not constitute a technical restriction on its access.

The OpenAI–Hugging Face incident illustrates why such limitations are important. The technical report describes how, during internal security assessments in July 2026, AI agents strayed beyond their intended environment. According to the report, they exploited vulnerabilities in supporting software, combined with exposed access keys, to reach external systems. The evaluation environment did not have the same safeguards as the regular production environment. The incident therefore does not provide a basis for concluding that every chatbot exhibits the same behaviour. However, it does highlight that supporting software and shared access can undermine a security boundary. This dependency also exists in a cooling system controlled via external management systems.

Furthermore, an implementation plan for the AI Regulation must take into account the amendment introduced by the 2026 Digital Omnibus on AI. For certain high-risk components, the application date has been postponed to 2 December 2027 for systems listed in Annex III and to 2 August 2028 for certain product-related high-risk systems. Not all AI rules have therefore been postponed. The amended provision on AI literacy requires providers and controllers to take measures to support the development of such literacy amongst staff and other relevant individuals. In practical terms, this calls for guidance tailored to the workplace: which applications are permitted, which data may be used, and when should someone intervene or escalate the matter? If a high-risk AI component forms part of a digital product, CRA compliance may, subject to certain conditions, contribute to demonstrating compliance with the AI cybersecurity requirements. Other AI obligations continue to apply separately.

What do the cyber rules mean for the government and consumers?

For the public sector, there is the same need to translate legislation into effective processes. It is not only a regulator and provider of information, but also a user and purchaser of digital systems. Within its legal scope, the Cybersecurity Act covers both central and local government organisations. Imposing requirements on a supplier does not relieve a local authority or water board of the responsibility to manage its own access and risks. Public procurement must therefore, from the outset, focus on support, security, verifiable performance and continuity. In addition, sufficient capacity, useful information and cross-border cooperation are required. A warning about a vulnerability must not only be issued, but must also lead to a clear mandate, a designated person responsible for implementation and monitoring of the outcome.

Citizens have a different role to play in this regard than manufacturers or regulated organisations. For consumers, installing updates, following security instructions and limiting unnecessary connections are useful steps. To do so, however, they must be able to understand how a product works and for how long it will be securely supported. Research by the ACM and RDI into smart consumer devices revealed shortcomings in the information provided about updates and in the delivery of those updates. Responsible use cannot compensate for inadequate product security or a lack of support. Society benefits from a division of responsibilities in which manufacturers supply secure products, organisations manage their environments and users receive useful information.

How should you respond following a cyber incident?

If an incident does occur, the technical response and legal assessment must begin simultaneously. Under the Cybersecurity Act, essential and important entities are required to report significant incidents. The standard reporting procedure requires an immediate notification or, where this is not possible, notification within 24 hours of becoming aware of the incident, followed by a further report within 72 hours. A manufacturer may also have its own CRA reporting obligation. Both assessments are independent of whether personal data has been affected. A hacked cooling system does not automatically constitute a GDPR data breach. For that to be the case, the security breach must, for example, result in unauthorised access to, loss of or alteration of personal data. This may also be the case where the IoT device acts as a gateway to data stored elsewhere.

An incident response procedure must address these differences in advance. Set out who is responsible for gathering the technical facts, who assesses the reporting criteria and who is authorised to take action. Specify what information suppliers must provide immediately and how those involved can be contacted outside office hours. Keep relevant logs and record the decisions taken. A single reporting form or a general contingency plan is not sufficient if no one is responsible for its implementation and follow-up.

Who is liable for damage caused by a cyber attack?

Financial settlement also begins with clear agreements. The fact that a cyber attack has been successful does not automatically make a supplier liable. In its judgement of 25 February 2025 concerning the attack on the municipality of Hof van Twente, the Arnhem-Leeuwarden Court of Appeal focused on the specific agreed obligations and compliance with them. For businesses, this means that IT contracts and maintenance agreements must clearly describe who manages access, provides updates, assesses security alerts and investigates incidents. Furthermore, be specific about items of damage and limitations of liability. A general assurance that a system is secure does not prevent disputes from arising later regarding the work actually commissioned.

The revised European Product Liability Directive explicitly includes software and cybersecurity in the assessment of product safety. However, it does not provide a safety net for every type of commercial loss. Items used exclusively for professional purposes fall outside its scope of liability. The Directive must be transposed by 9 December 2026 at the latest and applies the new regime to products placed on the market or put into service after that date. Contractual and other grounds for liability therefore remain important for lost trading stock and business interruption. Insurance cover also warrants separate assessment: the existence of cyber insurance does not automatically mean that every instance of physical damage or loss of turnover is insured.

Cybersecurity for businesses is thus a matter of technology, organisation and the legal allocation of risk. Legal advice on the IoT, NIS2 compliance, the Cyber Resilience Act and the responsible use of AI helps to determine which obligations apply and how these can be incorporated into supplier contracts and business processes. The value of this becomes particularly apparent in implementation. Every key digital connection must have a clear purpose, appropriate security measures and a responsible administrator. The hacked refrigeration units illustrate why: a seemingly minor issue can have major consequences, whilst a measure implemented in good time can make the difference between a manageable disruption and a business in disarray.

Questions

Do you have any questions regarding this article? Our solicitors are on hand to advise you! Please get in touch with one of our solicitors by email, telephone or by filling in the contact form for a no-obligation initial consultation. We’d be happy to discuss this with you.

Frequently asked questions about IoT, cybersecurity and liability