Remote sabotage and burning refrigerators. Cyberattacks can physically paralyse a store and clean shelves

Hackers are increasingly dissatisfied with data theft alone. According to the “Global Threat Intelligence” report for September 2026, organisations around the world experienced an average of 2803 cyberattacks per week, which is an increase of 16 per cent month-on-month and as much as 48 per cent year-on-year. The September data also indicates an intensification of various types of cyber threats. As Exorigo-Upos experts note, stores’ physical infrastructure is increasingly becoming a target of attacks. Hackers can remotely shut down cash registers, raise refrigerator temperatures, or overload systems and, as a result, cause fires.

A modern store is much more than cash registers, shelves and warehouse facilities. The daily work of a branch increasingly depends on the interaction of many interconnected systems and devices: cash register software, inventory management solutions or systems controlling product storage conditions. Integrating these technologies improves customer service and store management, but it also makes cybersecurity a prerequisite for business survival and a way to avoid multi-million losses.

Digital attacks, real threats

„Scenarios that not so long ago appeared only in movies are now becoming reality. Today’s cyberattacks are no longer just about silent data theft or shutting down an online store. Criminals target critical operational links, block payment terminals, cut off deliveries by blocking warehouse management systems, and paralyse the flow of product and price data. As a result, a single digital incident can completely stop in-store sales and traffic”, says Michał Tomaszewski, CISO, Security Team Manager at Exorigo-Upos and Co-founder & Board Member of Knoxter.

As Bloomberg Law points out, the operational technology (OT) layer and IoT solutions, including air conditioning, heating, and lighting systems, are increasingly becoming targets of strikes. Moreover, the BBC highlights the dangerous evolution of criminals’ strategies. Hackers are increasingly not only blocking access to systems, but also taking physical control of devices to threaten staff. As the industry portal The Register adds, attacks on building automation systems (BAS) are already being reported in many countries, during which cybercriminals block, for example, electronic access cards, locking employees inside areas of the building or cutting off their access to rooms.

Long-term effects

Attacks on key store systems increase the risk of delays, downtime, additional costs, and difficulty fulfilling orders. For infrastructure that stores products, the consequences can also affect product quality and immediate security. A recent example occurred in France. Hackers took control of the energy and air-conditioning management systems of a large supermarket chain and remotely raised the temperature in industrial refrigerators to 50°C. This led not only to food spoilage and forced closures, but also to overloaded electrical systems and fires in several facilities.

However, the effects of such incidents go far beyond immediate material losses. Supply chain immobilisation creates cascading delays across the logistics network, leading to multi-day shelf shortages and direct revenue losses. On top of that, consumer trust erodes. A customer who bounces off closed doors, finds empty shelves, or suffers during such a cyber-physical attack will choose the competition without hesitation.

From digitalisation to operational resilience

Automation, AI, and IoT solutions are unquestionably revolutionising commerce. However, the drive for innovation must not overshadow security issues. Traditional protection methods based solely on external firewalls are insufficient today, as the line between the IT environment and operational technologies in the store blurs.

“Cyber resilience begins at the stage of system architecture design and software development, not only at the moment of detecting an attack. In retail, where sales, warehouse and operational infrastructure systems are interconnected, it is crucial not only to prevent incidents, but also to mitigate their effects. System segmentation, access control, the ability to isolate failures, and mechanisms for operating in emergency mode help reduce the risk that a problem with one component will disrupt the entire facility. Therefore, the technological maturity of a company means not only the ability to implement innovations, but also the ability to ensure business continuity in crisis situations,” explains Jakub Rutkowski, Head of Engineering at Exorigo-Upos.

Today’s cyber resilience in the retail industry is much more than bans and firewalls. It is operational continuity and the ability to survive an attack without closing stores. In the world of connected technologies, a retail chain’s maturity isn’t defined by the absence of threats, but by its ability to isolate them immediately and keep customer service uninterrupted.

FAQ