This Is What NIS2 Should Really Be For

On 2 November 2026, cyber incidents disrupted refrigeration systems at supermarkets across Europe, including in Italy. This is a powerful example of why cybersecurity should not be treated as an exercise in regulatory compliance, but as a matter of corporate governance. It also shows why the EU’s NIS2 Directive, although no silver bullet, could drive a much-needed change in organisational culture.

Turning a freezer into an oven was enough

Across Europe, supermarkets suddenly found themselves unable to control refrigerators and freezers. Temperatures reportedly rose to 50°C, leaving food spoiled, stocks to be discarded and operations disrupted. ICA and Coop stores were affected in Sweden, with incidents also reported in Belgium, Luxembourg, Ireland, Estonia and elsewhere. In Italy, ANSA reported confirmed attacks against refrigeration systems at Coop stores in Sicily.

The attackers did not need to steal sensitive records, empty bank accounts or encrypt corporate servers with ransomware. They targeted something many people would not even think of as an IT system: refrigeration controls. Yet these installations depend on controllers, software and connections often used for remote monitoring, maintenance and technical assistance.

The consequences were physical, financial and operational. This was not even the first wave. On 12 October, hundreds of French supermarkets had experienced similar incidents, prompting France’s CERT-FR to issue a technical alert about remotely managed refrigeration controllers.

The question is no longer whether these systems can be compromised. It is why we continue to expose them when the risks are already known.

Our weakness is not just technological. It is organisational.

For years, we approached cybersecurity primarily as an IT issue. We protected servers and endpoints, installed firewalls, deployed detection systems and invested in email security. These measures remain essential. Yet production and service delivery also rely on industrial machinery, air-conditioning plants, refrigeration equipment, automation systems and connected controllers.

We have digitalised operations faster than we have learned to secure them.

The divide between Information Technology (IT) and Operational Technology (OT) is particularly important. OT controls physical processes, but its governance is often fragmented. A plant may belong to the maintenance department, its connectivity may be managed by an external supplier, its software may be proprietary and its remote access may be controlled by service engineers.

So who is accountable for the security of the whole system? The CIO? The plant manager? Procurement? The maintenance contractor? The manufacturer?

If there is no clear answer, we have already identified an organisational vulnerability.

Following the October incidents in France, CERT-FR documented compromises affecting different families of refrigeration controllers and highlighted the risks associated with Internet-exposed administration interfaces. This does not prove that every incident on 2 November used the same attack vector. It does, however, reveal a systemic weakness: equipment and remote access arrangements that receive too little attention.

We should not assume that every successful intrusion involves an exceptional technical breakthrough. Sometimes the weakness is far more mundane: missing baseline controls, blurred responsibilities and technology no one is actively overseeing. Technology can be complex. Vulnerabilities can be remarkably simple.

Not every cyberattack is about stealing money

When executives think about cybercriminals, they often picture stolen data, fraud or ransomware. That is an incomplete view of the threat. In a geopolitical context, an operation may be intended to interrupt services, degrade infrastructure or undermine economic and social continuity, even when there is no immediate financial gain.

We must distinguish a plausible risk scenario from a proven attribution. Based on the publicly available information considered here, there is not enough evidence to attribute the supermarket incidents of 2 November to a state or a coordinated geopolitical campaign. Responsibility and methods remain under investigation.

Nevertheless, these events illustrate the consequences of targeting service availability rather than data confidentiality. Extend the same logic to logistics, food distribution, energy, healthcare or telecommunications: an infrastructure does not have to be destroyed to become temporarily unusable.

The effects can spread to suppliers and customers, reduce the availability of goods, create economic losses and undermine confidence. A localised outage can often be managed; simultaneous and prolonged disruptions may become a political and social problem. The European Commission itself has highlighted the potential impact of these incidents on the food supply chain.

The resilience of an economy is not determined by its strongest company. It also depends on the ability of its most vulnerable links to withstand disruption. That is why cybersecurity has become a matter of economic stability and national security, not merely information protection.

So is NIS2 failing?

The European Union introduced the NIS2 Directive to strengthen the cybersecurity and resilience of organisations operating in sectors that matter to the economy and society. Italy transposed it through Legislative Decree 138/2024.

Yet we continue to see incidents involving known weaknesses, insufficiently protected systems and fragmented accountability. Does that mean NIS2 is not working? What we can certainly say is that we have not yet reached the level of resilience we need. It would be misleading, however, to claim that these events prove the directive has failed.

No regulation can prevent every attack, and organisational transformation does not happen overnight. Nor does every supermarket affected by these incidents automatically fall within the directive’s scope. In the food sector, NIS2 covers defined types of activity, including wholesale distribution and industrial production or processing, subject to additional legal criteria.

The deeper problem is cultural. Too often, compliance is treated as a documentation project. Policies are approved, risk registers completed, procedures filed away and evidence assembled. Then an incident reveals that a critical system is exposed to the Internet or that a supplier’s remote access has never been properly controlled.

We have the paperwork. We do not have the protection. An approved procedure will not stop an attack. A completed risk assessment will not, by itself, keep an operation running. If compliance only serves to prove that something was done, we have missed the point.

Here is what NIS2 should really be for

I strongly support NIS2. Not because businesses need more red tape, nor because I believe sanctions are the best way to encourage responsible behaviour. I support it because it can compel organisations to confront risks they have too often preferred to overlook.

The directive brings cybersecurity into boardrooms and executive decision-making. It calls for structured risk management, proportionate safeguards, supplier oversight, incident management and business continuity. Above all, it establishes a crucial principle: security is not simply the IT department’s responsibility. It is an organisation-wide responsibility.

Board members and senior executives should know which processes could be brought to a halt, how long the business could cope without its essential systems and which providers it relies upon. They should demand evidence that safeguards actually work, not merely documents saying that those safeguards exist.

The real value of NIS2 is not to force companies to claim that they are secure. It is to encourage them to become genuinely resilient.

What does being unprepared really cost?

When companies consider cybersecurity investment, they often focus on two figures: the cost of protective measures and the potential regulatory fines. That is an incomplete calculation.

Take a supermarket. An attack against refrigeration controls can lead to the loss of inventory, interrupted sales, emergency repairs, replacement stock, staff diverted to crisis management and reputational damage. It does not take a company-wide shutdown to cause serious harm: losing control of just one critical operational process may be enough.

The cost of a cyber incident is not the same as the cost of fixing the IT problem. It includes the financial consequences of interrupted operations. The right question is not merely, “What will it cost to protect this system?” It is also, “What could it cost us if the system fails, and how long would recovery take?”

Regulatory penalties are a genuine concern. But paper compliance can leave a company exposed to losses far greater than any fine, while providing little real ability to respond.

Six checks every organisation should make

1. Identify every system that supports critical processes

Look beyond laptops, servers and enterprise applications. Include plants, industrial controllers, automation systems and connected devices. You cannot reliably protect what you do not know exists.

2. Review remote access and Internet exposure

Administrative interfaces should not be directly exposed without appropriate protection. Supplier access must be authorised, authenticated, restricted to operational needs and logged.

3. Manage obsolescence and security updates

A device may work perfectly as machinery while being dangerously insecure as a connected system. Unsupported components, known vulnerabilities and update constraints must influence risk decisions and capital planning.

4. Make accountability clear across outsourced services

Outsourcing a plant or service does not automatically outsource your responsibility for managing risk. Contracts, assurance, incident procedures and genuine supply-chain governance are essential.

5. Test business continuity, rather than just documenting it

Business continuity and incident response need realistic scenarios, accountable owners, regular exercises and alternative ways to sustain essential operations wherever technically feasible.

6. Measure security outcomes, not paperwork

How many critical systems are inventoried? How many remote access paths are protected? Which vulnerabilities have been remediated? Which suppliers have been assessed? Do recovery arrangements work in a real exercise? These measures say far more than a signed checklist.

Cybersecurity is a shared responsibility

We should protect ourselves not only for our own sake, but also so that our weaknesses do not become someone else’s problem.

A vulnerable company can become an entry point into other organisations. One compromised supplier can disrupt dozens of customers. A logistics outage can ripple across an entire supply chain. Everyday life depends on digital systems and on the businesses responsible for operating them.

Protecting these systems helps preserve trust, service continuity and collective prosperity. It is also a matter of mutual respect for customers, employees, suppliers and the wider community.

NIS2 should build resilience, not a collection of compliance certificates

The incidents of 2 November do not show that NIS2 is pointless. They show how much work remains to be done. The directive is an important tool, but it cannot deliver results without real cultural change.

We do not need more procedures written solely to tick a regulatory box. We need organisations that understand their risks, accept responsibility for them, prepare for incidents and test whether their defences really work.

I do not want a Europe where every company can display a certificate of compliance. I want a Europe where companies are genuinely harder to compromise, better equipped to withstand disruption and faster to recover.

Protecting an organisation means more than protecting its balance sheet. It means helping to safeguard the economy and society in which we all live. That responsibility exists long before any legal obligation.

Sources and further reading

• Reuters, 2 November 2026 – European supermarket refrigeration incidents.
• Associated Press, 2 November 2026 – Supermarket refrigeration incidents across Europe.
• ANSA English, 2 November 2026 – Italy’s cybersecurity alert.
• SVT Nyheter, 2 November 2026 – Swedish cybersecurity experts on known risks.
• CERT-FR, 12 October 2026 – Security alert covering remote refrigeration controllers.
• Directive (EU) 2022/2555 (NIS2) and Italy’s Legislative Decree 138/2024.