Hack One, Reach Hundreds: What Supermarkets, Water, and Ports Have in Common
For most of my career, critical infrastructure attacks had a name and an address. A water plant in Oldsmar. A pipeline company in Georgia. A dam in Norway. People named attacks after where they happened, the company hit, or the malware responsible, and you could see them represented by pins on a map (the best maps look like WarGames control centers…).
The last four months have taken the pins away. Three incidents, three sectors, and the same lesson: the attackers no longer need to find you. They just need to find the thing you share with everyone else (psst…your vendor vulnerability). And the blast radius isn't limited to a single location.
July: one playbook, a dozen states
In July, attackers went after US water and wastewater utilities. CISA later put a number on it, the first time federal agencies had: "In July 2026, CISA observed malicious cyber activity targeting over 100 internet-exposed systems in the Water and Wastewater Systems (WWS) Sector, commonly via programmable logic controllers (PLCs) connected directly to a cellular modem."
By mid-August, attacks on internet-exposed PLCs had been reported in at least a dozen states. In Clayton County, Georgia, one attack caused a drop in water pressure and a boil-water advisory. In Colorado, the governor's office confirmed that attackers at two small utilities changed equipment settings, disabled remote access and alarms, and altered pumping cycles. The disruptions were brief, and service wasn't affected, but sit with the alarm detail for a second. The alarm was the control, and the attacker turned it off.
The State Department has since offered up to $10 million for the IRGC cyber commander it says directs the campaign, and MITRE's ATT&CK v20 now tracks the attacks on more than 30 Minnesota water systems as a named campaign, C0066.
The most important finding for everyone else came out of the investigation. According to a LevelBlue SpiderLabs review of the campaign, the FBI found common network configurations supplied by third-party providers across multiple victims. Compromise one integrator's design and the same way in works at utility after utility.
October: one weekend, seven hundred supermarkets
On the night of 11 October, attackers took remote control of refrigeration controllers in French supermarkets and pushed fridges and freezers into defrost. Le Monde reported that the attackers stretched defrost cycles from one hour to as many as eight, so the warming looked like routine maintenance and alarms were delayed. Again, the attackers targeted the alarms.
France's finance minister put the count at about 700 of the country's roughly 10,000 supermarkets, across Carrefour, Coopérative U, E.Leclerc, Intermarché and Monoprix. The Paris prosecutor confirmed fires and spoiled food. Two stores in Alsace alone reported combined losses of 270,000 euros. CERT-FR named the Danfoss AK-SM and AK-SC series, later adding Copeland and Dixell XWEB systems, and Danfoss said most of the units hit were older, unsupported models.
Here's what nobody knows yet: how the attackers got in. CERT-FR hasn't tied the compromises to any CVE, and no one has claimed the attack. I won't pretend otherwise.
What we do know is how exposed this class of device was. Censys counted nearly 3,000 internet-exposed Danfoss StoreView control panels on 11 October, more than 1,800 of them in France. By 14 October, the French count was down to 537, and patched and unpatched versions were disappearing at roughly the same rate. Operators weren't updating. They were unplugging.
Les Mousquetaires, which owns Intermarché, told CNBC the attack came through a service provider that managed refrigeration in some of its stores. That's disputed, and right now it's a liability argument between a grocer and a vendor rather than a finding. But it points to the same place the water investigation did.
This week: one vendor, thirty-eight companies (allegedly)
Then the ports. An extortion group calling itself n0n posted 38 maritime and logistics organizations across 18 countries to its leak site: container terminals, shipping lines, port IT providers and logistics firms. It claims vessel schedules, container manifests, gate movement records, and terminal configuration records, and demands that maritime security firm Cydome put them up for sale at $400,000 to $400 million per company. Most of its deadlines fell at 13:27 UTC on 19 October.
Those deadlines have passed. As I write this, no listed organization has confirmed an incident, and I haven't seen independent confirmation of what, if anything, was released. Treat every word of it as a claim. Nothing claimed touches a crane, a vessel, or a terminal control system. These are business records.
But the most careful analysis points to one thing. SOCRadar noted that the small, repetitive data sets point to "a shared application or vulnerability, rather than separate intrusions." Cydome assessed that the listings likely come from a single CyberLogitec support and project archive, split into per-customer listings, and counted at least 21 of the 38 as documented CyberLogitec customers. CyberLogitec has confirmed the named Korean companies are customers, says their systems are operating normally, and hasn't confirmed an incident.
If that holds, it's the same shape again. One archive. Thirty-eight names.
What's actually escalating
"Attacks are escalating" is the most overused sentence in our industry, and our public OT incident data doesn't support the generic claim. Waterfall and ICS STRIVE's 2026 OT Cyber Threat Report found that "In 2025, there were 57 breaches that met the strict inclusion criteria for this report: a surprising 25% decline over 2024." The same report expects ransomware to "again start to increase at near-historic 30-60% per annum rates in 2026-2027."
So the count isn't the story. The reach is.
The attacker didn't have to manually find a hundred utilities, seven hundred stores, or thirty-eight shipping companies one at a time. Each time, something sat in the middle: an integrator's network design, a fleet of identical internet-facing controllers, possibly a single vendor's archive. Find the shared thing once, and you've found everyone behind it.
Now add AI. For thirty years, reconnaissance was the expensive part of an attack. It took a human with time, skill, and patience, so attackers had to choose targets, and most plants weren't worth choosing. AI removed that cost. Scanning is now free, continuous, and universal.
Put those two things together. When finding things is free, and one finding reaches a whole customer list, being discoverable stops being a probability. It becomes a schedule. The question isn't whether your exposed asset gets found. It's what date.
What we do about it
Get management interfaces off the internet. CERT-FR's advice to French retailers was blunt: take those controller series off the internet or filter access tightly. That advice applies to every remote management interface you own; it costs nothing, and the Censys numbers show operators can do it in days when they have to.
Treat vendor access as the front door. Every story above runs through someone else's access: an integrator, a refrigeration provider, a software vendor. Third-party access should be bound to an identity, granted per session, require no inbound ports, and be something an operator can end while it's in progress.
Assume your inventory is incomplete. Any control that starts from an asset list only protects what's on the list. The refrigeration controller in the back of the store was on somebody's inventory. Probably not the security team's.
Make the asset stop answering. This is the part BlastWave was built for. BlastShield silently drops unauthenticated packets. Nothing is sent back, so a scanner can't tell a protected controller from empty address space. Anything not explicitly configured with a policy is blocked and logged the moment it tries to connect. In plain language, your PLCs stop answering scans. Detection finds it. BlastWave makes it unreachable.
The next attack on critical infrastructure probably won't have an address. It'll have a customer list. The only question worth asking is whether your name is on it, and whether anything answers when the attacker comes looking.
Frequently Asked Questions (FAQs)
1. What do recent cyberattacks on supermarkets, water utilities, and ports have in common?
Recent 2026 cybersecurity incidents highlight how shared technology, vendor access, and common network configurations can expose hundreds of organizations to the same attack methods. Attackers can exploit internet-facing industrial controllers, repeatable integrator configurations, or potentially compromised third-party systems to reach multiple targets without attacking each organization individually.
2. How do third-party vendor vulnerabilities create widespread OT cybersecurity risks?
Third-party vendor vulnerabilities create systemic risks when multiple organizations rely on identical equipment, software, network configurations, or remote access systems. A single weakness can provide attackers with a repeatable path into numerous customer environments. This makes vendor access security, Zero Trust enforcement, and network exposure reduction critical to protecting operational technology (OT) infrastructure.
3. What happened during the July 2026 cyberattacks on U.S. water utilities?
In July 2026, CISA observed malicious cyber activity targeting more than 100 internet-exposed systems in the U.S. water and wastewater sector, frequently involving programmable logic controllers (PLCs) connected through cellular modems. Investigations identified common network configurations supplied by third-party providers across multiple victims, demonstrating how shared infrastructure can create widespread cybersecurity exposure.
4. How did attackers compromise refrigeration systems at French supermarkets in October 2026?
In October 2026, attackers remotely manipulated refrigeration controllers at approximately 700 French supermarkets, extending defrost cycles and delaying alarms. Affected equipment included Danfoss controllers and other industrial refrigeration management systems. The initial intrusion method remains unconfirmed, but the incident demonstrates the risks associated with internet-exposed operational technology, legacy controllers, and shared management infrastructure.
5. What do the October 2026 maritime and logistics cyberattack claims reveal about supply chain security?
An extortion group claimed to possess business records associated with 38 maritime and logistics organizations across 18 countries. Security researchers suggested the listings could originate from a shared software provider or support archive rather than 38 separate intrusions. These claims remain unverified, but they illustrate how centralized third-party data repositories can create supply chain cybersecurity risks affecting multiple customers.
6. How does AI-powered reconnaissance increase cybersecurity risks for critical infrastructure?
AI-assisted reconnaissance can accelerate the discovery and analysis of internet-exposed devices, services, and vulnerabilities. When multiple organizations use the same controllers or network configurations, attackers can potentially scale their targeting across entire customer groups. Reducing network visibility and restricting unauthorized access helps limit exposure to automated reconnaissance.
7. What is network cloaking, and how does it protect industrial control systems?
Network cloaking is a cybersecurity approach that prevents unauthorized users and scanners from discovering or communicating with protected network assets. BlastWave's BlastShield uses Zero Trust network cloaking to silently drop unauthenticated packets, making protected PLCs, industrial controllers, and other OT assets unresponsive to unauthorized network scans while maintaining policy-controlled access for authorized users.
8. How can organizations secure third-party remote access to OT networks?
Organizations can protect third-party OT access by requiring identity-based authentication, granting access only to authorized systems, enforcing least-privilege permissions, and limiting access to specific sessions. Secure remote access solutions should avoid unnecessary inbound ports and allow operators to revoke access immediately. These controls reduce the risk that compromised vendor credentials or shared remote management infrastructure will expose critical OT systems.
9. Why is traditional asset discovery insufficient for OT cybersecurity?
Traditional asset discovery depends on maintaining an accurate inventory of connected devices. However, industrial environments frequently contain legacy PLCs, refrigeration controllers, vendor-managed equipment, and other assets unknown to centralized security teams. Organizations should combine continuous asset discovery with default-deny network access policies so that unidentified or unauthorized devices cannot establish unapproved communications.
10. How does BlastWave BlastShield help prevent widespread critical infrastructure cyberattacks?
BlastWave BlastShield reduces OT cybersecurity exposure through network cloaking, Zero Trust access controls, and software-defined microsegmentation. It silently drops unauthenticated traffic, prevents unauthorized reconnaissance of protected assets, and restricts communication to explicitly authorized connections. These controls help protect industrial systems from scanning-based attacks and limit the pathways attackers can exploit through shared vendor infrastructure.
How To: Protect Critical Infrastructure From Shared Vendor Vulnerabilities and Large-Scale OT Cyberattacks
Protecting critical infrastructure from widespread cyberattacks requires reducing exposed management interfaces, controlling third-party access, identifying unmanaged assets, and preventing unauthorized network reconnaissance. The following steps help organizations limit the impact of vulnerabilities shared across utilities, industrial facilities, retail environments, and transportation networks.
Step 1: Identify internet-exposed OT devices and management interfaces
Audit operational technology networks for publicly accessible PLCs, SCADA systems, refrigeration controllers, industrial gateways, cellular modems, and remote management interfaces. Use internal asset inventories and authorized exposure assessments to identify systems reachable from the public internet.
Goal: Establish which critical OT assets are discoverable and potentially accessible to unauthorized external users.
Step 2: Remove unnecessary internet exposure
Disconnect industrial management interfaces from direct public internet access wherever possible. For systems requiring remote connectivity, restrict access through tightly controlled, authenticated connections rather than publicly accessible management ports.
Goal: Reduce the attack surface by eliminating unnecessary entry points into critical infrastructure.
Step 3: Audit third-party vendors and shared network configurations
Identify integrators, maintenance providers, software vendors, and service providers with access to operational systems. Review shared configurations, remote access methods, legacy equipment, and vendor-managed infrastructure for repeatable vulnerabilities affecting multiple sites.
Goal: Prevent a single vendor weakness or insecure configuration from creating an attack path across multiple facilities.
Step 4: Implement Zero Trust secure remote access
Require identity verification for every remote connection. Grant vendors access only to the specific systems needed for their work, enforce least-privilege permissions, avoid unnecessary inbound ports, and provide operators with the ability to terminate active sessions.
Goal: Ensure third-party access is authorized, limited, and immediately revocable.
Step 5: Apply default-deny policies to OT network communications
Configure network access controls so that only explicitly authorized users, devices, and services can communicate with protected assets. Block unauthorized connection attempts and log policy violations for investigation.
Goal: Prevent unknown, unmanaged, or unauthorized connections from reaching critical industrial systems, even when asset inventories are incomplete.
Step 6: Deploy network cloaking to prevent unauthorized reconnaissance
Use BlastWave BlastShield to cloak protected PLCs, industrial controllers, and other OT assets. BlastShield silently drops unauthenticated packets rather than responding to scanning attempts, preventing unauthorized scanners from identifying protected services.
Goal: Make protected OT assets undiscoverable through unauthorized network scanning while preserving approved operational communications.
Step 7: Validate network protection and continuously review vendor access
Test that unauthorized scanners cannot discover protected OT systems, verify that legitimate operational traffic continues functioning, and confirm that vendor access can be revoked when necessary. Regularly review logs, access policies, equipment exposure, and changes to third-party infrastructure.
Goal: Maintain effective Zero Trust protection as OT environments, vendor relationships, and attacker techniques evolve.
Expected Outcome
By combining network cloaking, secure third-party access, default-deny policies, and ongoing asset visibility, critical infrastructure operators can reduce their exposure to large-scale cyberattacks that exploit shared vendor vulnerabilities. BlastWave BlastShield helps organizations move beyond detecting exposed OT assets toward preventing unauthorized systems from discovering and communicating with them.
American Water’s cyber incident shows why water utilities need stronger OT isolation to stop IT breaches from threatening critical infrastructure operations and availability.
Explore the complete analysis of 23 OT attacks that defeated firewalls, VPNs, and air gaps.
.svg)
.svg)
