The Cyber-Physical Inflection: When Everyday Systems Become Weapons

No malware, no data stolen, no ransom. Only destroyed stock. That is the inflection.

In October and November 2026, attackers logged into ordinary refrigeration controllers at some 700 French supermarkets, then at sites across 12 European countries and at the French blood service, and raised the temperature setpoints. France has since attributed the October wave to a state unit that scanned for controller brands, not for company names. The same pattern applies to any exposed PLC, HVAC unit, pump or charging point, in retail, food, pharma, logistics, manufacturing, energy and water.

Defense does not require new technology. It requires closing the direct path from the internet to the controller, brokering every vendor access, and detection the attacker cannot mute. The attribution took four weeks; the damage took four hours.

Sia's briefing, written for boards, COOs, CIOs and CISOs, follows the attack in four parts, from what happened to what a system that holds looks like, and maps the five controls that close the door to IEC 62443, NIST CSF 2.0 and NIS2.

For each part, it provides the facts, the business case and the first actions for your teams, with a reference architecture, a board KPI set, an incident reflex card and a 30-day checklist. Actionable from day one.