When Cyberattacks Start Thinking

The part that should make us uncomfortable

In October, refrigeration systems in French supermarkets were manipulated. In early November, similar incidents were reported across several European countries. Think about what that means for a moment: the attacker did not need to steal a customer database to create a business crisis. A temperature controller was enough. ENISA confirmed incidents from 11 October and a new wave on 1–2 November.

At almost the same time, another story was unfolding in a completely different part of cybersecurity. Google's threat intelligence team documented an adversary using an AI-assisted, multi-agent workflow to conduct a credential-harvesting campaign in under six hours. The two cases are not one campaign, and there is no established evidence that the European refrigeration incidents were AI-driven. But put them side by side and a difficult question emerges: what happens when fast, repeatable attack workflows meet the thousands of operational devices we still leave reachable from the internet?

That is the question I want to explore here. Not whether AI has magically made every attacker brilliant. It hasn't. The question is whether we have built an environment where ordinary weaknesses can be exploited faster, at greater scale, and with very real physical consequences.

Europe: the freezer was not the real problem

Editorial photograph

When a refrigeration unit stops holding temperature, the natural reaction is to send someone from maintenance. That makes sense. But commercial refrigeration is no longer just a compressor and a thermostat. Many installations use network-connected management systems that supervise several units, schedule defrost cycles, record temperatures and allow remote servicing.

That remote access is useful. A contractor can diagnose a problem without driving to every store. But it also creates a control plane: a place where a person with sufficient access can change how physical equipment behaves. If that interface is exposed to the public internet, the boundary between an attacker and a store's equipment may be much thinner than the store realizes.

During the European incidents, reporting described unauthorized changes to refrigeration settings, including defrost behavior and unusually high temperatures. Censys documented the second wave; ENISA urged immediate exposure reduction and coordinated response. The exact access route can differ by victim and should not be assumed from a news headline.

Here's the security lesson I take from this: an operational setting is a security-sensitive command. Changing a defrost schedule or setpoint is not merely a configuration tweak when the result can be lost inventory, disrupted services or damaged equipment.

What an attack path can look like

Let's separate a plausible technical attack path from what investigators have publicly confirmed. A remotely manageable controller may be found through internet exposure data. An attacker might then encounter a poorly secured login, a vulnerable management interface or an unsafe remote-access arrangement. If unauthorized access is gained, a control command can affect operating parameters. Finally, the organization notices an alarm, an abnormal temperature trend or an equipment failure.

This sequence is a defensive model, not a claim that every European victim was compromised by these exact steps. It is useful because each stage has a different control owner. Internet exposure belongs to network and asset management. Authentication belongs to identity and vendors. Command authorization belongs to OT engineering. Temperature alarms and fail-safe behavior belong to operations. The SOC cannot solve this alone.

Imagine an organization with a perfectly functioning EDR deployment on its laptops. That investment may do very little if a standalone controller has a public management port and no meaningful security telemetry. This is why I would ask my team for a list of externally reachable operational devices before asking for another malware dashboard.

The AI case that changes the speed discussion

Editorial photograph

Now consider Google's September 2026 report. Its researchers described a suspected financially motivated actor who compromised cloud infrastructure and used an AI coding chatbot, agent instructions and operational playbooks to help build and run a mass credential-harvesting workflow. The activity reportedly progressed from planning to execution in less than six hours and compromised thousands of third-party credentials. Read the original Google Threat Intelligence Group report.

The important detail is not the fashionable word agentic. It is the division of labor. The human supplied an objective. Instructions and tools handled repeatable tasks, processed results and dealt with some operational friction. Google described automated scanning, troubleshooting and IP-rotation logic. That reduces the pauses where a human would normally inspect an error, decide what to do next and restart a tool.

Does this prove fully autonomous AI can independently compromise any enterprise? No. The report describes a specific observed operation. But it does demonstrate that attackers can package knowledge and tools into repeatable workflows. If we measure defense readiness only by how quickly an analyst can manually investigate an alert, we may be measuring the wrong thing.

Japan: an important signal, but not the same incident

Editorial photograph

Japan provides another useful perspective. A Reuters survey published on 11 November 2026 reported that roughly one-third of responding Japanese companies had experienced cyberattacks against themselves or their service providers during the year, with around one in ten reporting operational disruption. This is survey evidence about business exposure, not proof of a single AI-driven attack on 700 Japanese systems.

The distinction matters. The approximately 700 retail sites mentioned in reporting about refrigeration attacks refer to France, not Japan. If we merge those stories, we create an impressive-looking narrative that is factually wrong.

What Japan's experience adds is the dependency problem. A business can be affected when a supplier, service provider or shared platform is compromised. Security teams need to understand not just their own assets but also the access and operational privileges granted to third parties. When AI makes reconnaissance and repetitive attack tasks cheaper, these shared dependencies become especially important to map and protect.

What I would actually ask the SOC and OT teams to do

I would not begin by buying an 'AI-powered defense platform.' I would begin with five uncomfortable questions.

First: Can we name every internet-reachable device that can change a physical process, including devices installed and managed by vendors? If not, start with external attack-surface discovery and confirm ownership before touching production equipment.

Second: Can we distinguish a legitimate maintenance action from an unexpected remote change? Capture controller configuration changes, remote-access sessions, administrative logins and unusual setpoint changes where supported. Feed meaningful events into the SOC, but avoid flooding analysts with raw telemetry they cannot interpret.

Third: What happens when a controller loses network connectivity or receives an unsafe command? Engineering teams should validate local safety limits, alarms, manual overrides and operational fail-safe procedures. A firewall rule cannot replace safe physical design.

Fourth: Are our AI tools allowed to execute actions with standing credentials? Treat agent identities as privileged non-human identities. Restrict tool scopes, require approval for high-impact actions, rotate secrets and log tool calls. A prompt is not an authorization boundary.

Fifth: Can we contain a fast-moving incident without waiting for five separate email approvals? Pre-authorize narrowly defined containment actions, test them in exercises, and give incident commanders clear escalation paths. Automation should accelerate safe response, not bypass accountability.

My closing thought

I do not believe AI has replaced the fundamentals of cybersecurity. An exposed interface is still an exposed interface. A weak credential is still a weak credential. An unmonitored privileged action is still dangerous.

What is changing is the amount of work an attacker can do between one human decision and the next. And at the same time, our businesses have connected more physical operations, service providers and AI agents to systems that matter.

That combination worries me more than the phrase 'AI cyberattack' itself. We should stop asking only whether attackers are using AI, and start asking whether our own environment gives fast-moving attackers too many easy paths to consequential systems.

Because when a cyberattack changes the temperature in a freezer, the incident has already left the screen.