CyberScope
CyberScope
October is Cyber Security Awareness Month, yet October 2026 has been nicknamed “Black October” by the security community. Supermarkets, hospitals, universities, government agencies and manufacturers across Europe and beyond were hit by ransomware, data breaches and, in one striking case, an attack that reached into the physical world.
Here are three stories from the past few weeks that every business leader should know about, what they have in common, and the practical steps that reduce your risk.
1. Hackers turned supermarket fridges up to 50°C
In mid-October, hundreds of supermarkets across France found their fridges and freezers had been remotely switched to around 50°C overnight while the stores were closed. More than 500 shops were affected, including Intermarché, Coopérative U, Carrefour, Monoprix and E.Leclerc stores. Fresh and frozen food worth millions of euros had to be thrown away, and some sites reported fires and damaged equipment.
According to reports, the affected refrigeration controllers were older models running outdated firmware and reachable from the internet. France’s national cyber security agency advised businesses using them to disconnect them from the internet or restrict access, and to install the latest updates.
Why it matters: this was an operational technology (OT) attack. It didn’t steal data; it changed how physical equipment behaved. Many businesses have similar connected systems, such as building management, refrigeration, production lines and remote maintenance links, that nobody is watching from a security point of view.
2. SafePay ransomware has hit more than 600 organisations
On 20 October, US agencies including CISA and the FBI, working with international partners, published a joint advisory on the SafePay ransomware group. It has compromised at least 600 organisations since August 2024, including many in critical infrastructure sectors across North America, Europe and beyond.
SafePay typically gets in through stolen or guessed passwords and known weaknesses in VPNs and other internet-facing devices. Once inside, it uses ordinary admin tools to move around the network, steals data and then encrypts systems, often within around 24 hours of taking the data.
Why it matters: 24 hours is not long. If nobody is watching your network overnight or at the weekend, an attack like this can go from first login to encrypted servers before anyone notices.
3. Ransomware in the UK: more than 26 businesses a month
Figures released by City of London Police show that 323 UK organisations reported being hit by ransomware between April 2025 and March 2026. That is more than 26 successful attacks every month. More than half of the victims were small and mid-sized businesses, and manufacturing was the most affected sector where it was disclosed. Reported financial losses rose by around 50% year on year, and police believe the true figure is higher.
Why it matters: ransomware is not only a problem for household names. Smaller organisations are now the majority of victims, often because they lack round-the-clock monitoring and a tested response plan.
What these attacks have in common
- Blind spots. Unmonitored devices, forgotten remote access and legacy systems give attackers a way in that nobody sees.
- Known weaknesses. Outdated firmware, unpatched VPNs and reused or weak passwords were behind many of these incidents.
- Speed. Attackers move quickly once inside. Detection and response need to work 24/7, not just during office hours.
- IT and OT are connected. An attack that starts on the office network can reach production, refrigeration or building systems, and the other way round.
Five steps to take now
- Know what you have. Build a complete inventory of your IT, OT and IoT assets, including anything connected to the internet.
- Close the easy doors. Update firmware and patch VPNs and edge devices. Turn on multi-factor authentication and remove remote access that is not needed.
- Watch around the clock. Make sure suspicious activity is detected and acted on at night and at weekends, across both IT and OT.
- Plan your response. Agree who does what during an incident, and rehearse it before you need it.
- Protect your backups. Keep secure, tested backups so you can recover without paying a ransom.
How CyberScope helps
CyberScope is a security system integrator protecting both IT and OT environments, delivered as a managed service:
- Discovery & Risk Assessment gives you full visibility of your IT, OT and IoT assets and the risks attached to them, including exposed and outdated systems like the ones targeted in France.
- 24/7 Managed Detection & Response and OT Active Monitoring mean our SOC analysts are watching your environment around the clock, so an attack is spotted in minutes, not days.
- Digital Forensics & Incident Response (DFIR) and Active Remediation contain an attack fast and find out exactly what happened.
- Incident Crisis Management supports your leadership team with communications and decisions during an incident.
- Pro-Active Readiness Program and Recovery & Restoration help you prepare before an attack and get back to normal operation afterwards.
Under attack right now? Call our 24/7 emergency line: English +1 (775) 577 7734, Spanish +34 511 603 759.
Want to understand your exposure before attackers do? Talk to our team about a risk assessment for your IT and OT environment.
