Μake us preferred on Google At 4 a.m. last Monday, employees at a butcher shop in Kifissia, a suburb north of Athens, noticed that something was wrong with the refrigerators. According to a complaint filed by the owner, someone had gained access to their control system and changed the temperature setting to 150 degrees Celsius (302 degrees Fahrenheit).
A technician needed approximately two hours to regain control of the system. Although the actual temperature never reached that level and the products were saved, the incident, which became public the following day, demonstrated how easily a business can be affected by a cyberattack targeting internet-connected equipment — and how vulnerable businesses and infrastructure can be. Even private homes are not necessarily safe.
There had already been a warning. On Oct. 14, Greece’s National Cybersecurity Authority (NCA) identified more than 300 commercial refrigeration control systems in the country that were exposed to the internet. It recommended disconnecting them or ensuring that any remote access was secure.
On Nov. 5, however, the authority clarified that it had received no official reports concerning the incidents at food businesses. Their characterization as cyberattacks was based on assessments by maintenance technicians. It remains unclear how many system operators were notified and took measures to address the risk.
Using Default Passwords
Speaking to TO BHMA, Digital Governance Minister Dimitris Papastergiou pointed to a frequently underestimated vulnerability: equipment connected to the internet for convenience, often without its original passwords being changed.
In commercial refrigerators, remote monitoring and temperature adjustments can thus become an entry point for malicious interference. The risk, he explained, extends beyond a computer or a file that might be stolen. It involves the operating parameters of an actual physical installation.
The recent refrigeration incident reveals just one aspect of a much broader problem. Similar risks affect numerous connected installations, including small-scale solar power facilities. Papastergiou described a possible scenario in which attackers interfere with remote-control systems and their production settings, potentially disrupting their operation.
Last October, research by Dutch company Modat identified 1,860 solar power systems in Greece that were accessible through the internet — the second-highest number among the countries examined, after Spain. Across 35 European countries, the research identified a total of 8,547 exposed systems at wind and solar installations.
What Happened in Poland
There is a documented European precedent for potential sabotage. In December 2025, a coordinated attack targeting more than 30 wind and solar installations in Poland disrupted communications with grid operators.
According to Poland’s Computer Emergency Response Team (CERT Polska), electricity production continued. The incident highlights the distinction between compromising control systems and causing a widespread power outage.
“There will always be small vulnerabilities,” NCA head Michalis Bletsas said in April 2025. He said Greece’s Independent Power Transmission Operator (ADMIE), Hellenic Electricity Distribution Network Operator (DEDDIE) and Public Power Corporation (PPC) were making substantial investments in cybersecurity, while also warning about the risk of physical sabotage targeting remote transformers and other facilities.
The security measures adopted by major operators, however, do not automatically reflect the situation at thousands of smaller connected installations.
ADMIE is strengthening physical surveillance through drones, in addition to protecting its information systems, while DEDDIE says it is investing in monitoring and recovery capabilities.
The Regulatory Authority for Energy, Waste, and Water (RAAEY) has included cyberattacks among the serious risk scenarios for electricity supply. This reflects the importance attached to such threats in contingency planning, but does not mean that every breach can cause a blackout.
In 2022, Greece’s Operator of the Greek National Natural Gas System, DESFA, also faced a cyberattack targeting its information systems, while maintaining the operation of the gas network.
Threats Spreading Through Third Parties
A vulnerability affecting one supplier can also spread to dozens of other organizations.
In September 2025, an attack on Collins Aerospace’s passenger-service software caused delays and cancellations at European airports, from Brussels to Heathrow.
Railways and ports were at the center of the pan-European Cyber Europe exercise in June 2026. Although the scenarios were simulated, they highlighted real challenges: legacy systems operating alongside modern applications, numerous stakeholders and shared dependencies on third-party providers.
In telecommunications, the threat can be less visible, as attackers may intercept information while the network continues to function.
In the banking sector, Bank of Greece Governor Yannis Stournaras has warned that attacks using artificial intelligence tools could temporarily disrupt services, distinguishing between the inability to access services and the loss of money.
A banking executive described daily security updates and system checks, while acknowledging the new challenges posed by the malicious use of advanced artificial intelligence.
Across the public sector, various systems continuously monitor network traffic so that unusual activity can be detected quickly. These include distributed denial-of-service (DDoS) attacks, which overwhelm services with traffic, as well as threats that may be introduced by a contractor or a device with access to an internal network.
The response depends on backup systems, vulnerability assessments and the time needed to restore a service following an attack. In hospitals, where different and often outdated systems coexist, this need is particularly pressing.
Who Is Responsible?
Greece has incorporated the European Union’s NIS2 Directive into national law, while a separate legal framework for the resilience of critical entities has also been in place since 2025.
Responsibilities are divided among the National Cybersecurity Authority, the General Secretariat for the Protection of Critical Entities, sector-specific regulators and the operators themselves. The new framework combines the protection of digital systems with the broader resilience of essential services.
In Kifissia, a technician managed to restore control of the refrigerators within two hours. At an energy network, an airport or a hospital, responding to a similar disruption could require the coordinated mobilization of multiple organizations.
The refrigeration incident nevertheless raises a question that comes even before the restoration of a system: the competent authority had already warned about the danger, but it remains unknown how many operators of vulnerable systems responded.
As digital connections multiply, this gap between receiving a warning and taking action is becoming increasingly important for the security of critical infrastructure.
Contributions: Mahi Tratsa, Kostas Delezos and Agis Markou.
