November is Critical Infrastructure Security and Resilience Month. Each year, CISA leads the national recognition, with a goal of educating and engaging all levels of government, infrastructure owners and operators, and the American public.

CISA’s message for the month: “Resolve to be Resilient so that, as a nation, we can continue operations or recover quickly in the event of disruption. From the front-line defenders to those who create tools and resources, everyone plays a role in the nation’s security and resilience.”

There are 16 critical infrastructure sectors, and CISA describes them as “a complex, interconnected ecosystem.” Food and agriculture, energy, water, and manufacturing are all part of it. A problem in one can ripple into the others.

That role starts with knowing your systems. What is connected, what it runs, and what normal looks like. Three recent stories show why it matters: a cyberattack on supermarket refrigeration across France, a 62% rise in food and beverage attacks in the first half of 2026 compared with the same period in 2025, and a federal warning about internet-exposed PLCs.

A Fridge Controller Becomes the Target

In October, attackers overrode the temperature controls on refrigeration systems at supermarkets across France. Reuters reports at least 350 stores were affected. Intermarché said fridges at about 150 of its stores were heated to as high as 50°C overnight, and it discarded all affected food.

The fridges ran Danfoss control software. Danfoss said many of the affected units had reached end of life or were running outdated firmware. Claroty’s Team82 had disclosed flaws in one Danfoss controller, the AK-SM 800A, on August 9, and updates have since addressed them. Reuters also found at least 4,500 Danfoss interfaces visible from the internet.

Ken Munro of Pen Test Partners called it “basic cyber hygiene” and described the attackers as “pushing at an open door.” As of mid-October, no group had claimed responsibility and investigators were still searching for the attackers.

The Pressure On Food and Manufacturing

The Food and Agriculture ISAC counted 227 attacks on food and beverage companies in the first half of 2026, up 62% from the same period in 2025. Zscaler’s ThreatLabz 2026 Ransomware Report, as reported by The Food Institute, counted 1,025 attacks on manufacturers, compared with 605 on the tech industry and 508 on healthcare.

Experts quoted by The Food Institute point to the same basics: separate production systems from corporate networks, restrict remote access, and regularly test backups of critical systems.

IBM’s Oscar Calderon described the stakes this way: “I’ve seen production stop not because equipment failed, but because teams could no longer trust control systems.”

A Federal Warning About Exposed PLCs

Programmable logic controllers (PLCs) run industrial processes. A joint advisory from the FBI, CISA, NSA, EPA, DOE, and U.S. Cyber Command’s Cyber National Mission Force warns that Iranian-affiliated actors are exploiting internet-exposed PLCs across U.S. critical infrastructure. The advisory was first published April 7 and updated July 22.

Michigan Farm News reports that these controllers run grain elevators, feed mills, irrigation pumps, ethanol plants, and food processing facilities. Officials warned that disruption could slow harvests, interrupt feed and fertilizer supplies, and create bottlenecks for farms and local economies. The article cites about 4,200 exposed connected devices. In the officials’ words: “In a few cases, this activity has resulted in operational disruption and financial loss.”

What the Three Stories Share

In France, control panels reachable over the internet ran outdated firmware. In the federal warning, internet-exposed controllers are the target. In the food industry reporting, experts keep returning to segmentation, restricted remote access, and tested backups.

Patching, segmentation, and access controls are the front line. People are what make them work. Trained personnel are better equipped to recognize exposure, put safeguards in place, spot tampering, and recover safely when defenses fail.

What Hands-On OT Training Builds

• Know the equipment. PLCs and HMIs control a physical process. Understanding how they behave in normal operation is the baseline.
• Know normal traffic. Industrial protocols such as Modbus/TCP communicate differently from business IT. When you know the pattern, the oddity stands out.
• Spot tampering. Unexpected changes to PLC configuration or logic mean something. Recognizing them is a skill.
• Practice the response. Isolating a system can affect operations. Practicing when to act, how IT, OT, and engineering coordinate, and how to restore from backups makes the call easier in the moment.

Reading about OT security is one thing. Knowing how to apply it is another.

Resolve to be resilient. Understand the systems you protect.

Ready to build hands-on OT skills? Explore OT BoOTcamp™ and TAC’s other training programs.

---

Sources & Research

• The Food Institute, “Food Industry Cyberattacks Jump 62% in 2026” (Oct 13, 2026): Food and Ag-ISAC stat, ThreatLabz counts, expert guidance, IBM quote.
• Reuters, via Business Insurance and The Star (Oct 12 and 13, 2026): France incident, Danfoss, Claroty disclosure, 4,500 interfaces, Munro quote.
• Michigan Farm News, “Iranian-affiliated cyber attacks target US food processors” (Apr 17, 2026): food and agriculture impact, 4,200 devices, officials’ quote.
• Joint advisory AA26-097A (first published Apr 7, 2026, updated Jul 22, 2026): agencies and dates.
• CISA, Critical Infrastructure Security and Resilience Month: opening quote.