A cyberattack does not have to steal your data to destroy your stock. On 2 November 2026, attackers targeted supermarket refrigeration systems across Europe, raised temperatures, and forced food to be discarded. Six Romanian stores also reported abnormal refrigeration temperatures in a suspected cyberattack.
Now consider the wider exposure. If an attack stopped your production controls, blocked access to orders, or disrupted a critical supplier, how long could your business keep delivering? If power or internet access also became unavailable, could leadership still direct the response?
Your customers would still expect delivery. Employees would need instructions. Every hour without a workable response would put more commitments at risk. The board’s problem would extend far beyond restoring computers.
A cyberattack can reach the systems that keep a business alive.
Cyberattacks can disrupt industrial controls and office networks. CERT Polska’s August 2026 investigation described a December 2025 attack that shut down a steam turbine and water-treatment system at a Polish combined heat and power plant. Operators limited the outage and maintained heat supplies. The incident demonstrates physical consequences and the value of a capable response.
For a company dependent on electricity, an attack affecting its energy supplier would create a different emergency from an intrusion into its own network. Machinery may stop. Refrigeration may lose cooling. Electronic access, lifts, and loading equipment may become unavailable. A secure office network cannot compensate for the loss of an essential external service.
The consequences extend beyond your own building. Norway’s civil protection authority explicitly asks households to prepare for disrupted electricity, water, internet, mobile networks, and payment services. It also points out that petrol and diesel pumps need electricity. These services are interdependent, not separate conveniences.
A generator can buy time, but the useful question is how much. You must establish its capacity, tested operating duration, fuel supply, and the equipment it actually supports. Keeping servers running may leave the production line idle. A backup communications route may rely on infrastructure affected by the same outage.
Cloud storage does not eliminate the need for power and connectivity where people work. Remote working does not solve an outage affecting employees’ homes. An alternative supplier is of limited value if it depends on the same affected infrastructure.
For a Romanian board, the task is to establish which activities become unsafe, impossible, or commercially damaging at different outage durations. Recovery priorities should follow those consequences. Companies that cannot answer until the power fails leave critical decisions dangerously late.
An attack can leave your data intact and your business unable to use it.
A cyberattack may disable a service, compromise equipment, or force systems offline while specialists contain the intrusion. Even with electricity available, losing internet access can prevent a company from reaching cloud applications, taking online orders, or exchanging essential information with partners. The data may be intact. The business may still be unable to use it.
When power and connectivity are both disrupted, their effects compound. A logistics team unable to retrieve dispatch instructions cannot simply tell everyone to work from home. A customer-service team without access to orders cannot credibly promise delivery dates. A management team cannot coordinate through a meeting link nobody can open.
Connectivity loss does not necessarily silence every telephone. But a response that assumes mobile calls, messaging apps, or a second connection will always work makes another untested promise. Alternatives need to be sufficiently independent of the failed service, available to the right people, and tested under realistic conditions.
The organization needs essential contacts, operating instructions, and delegated authority accessible without its usual systems. People need to know when and how to act if they cannot reach a manager. Regional headquarters must understand what local teams can decide without waiting for online approval.
Otherwise, leadership loses more than visibility. It loses time as employees improvise, customers seek answers elsewhere, and commitments pile up. The communication plan must function under the same damaged conditions as the operating plan.
Romania is already part of the cyber story.
On 2 November 2026, cyberattacks on supermarket refrigeration systems across several European countries caused temperatures to rise and food to be discarded. Some Swedish freezers reportedly reached 50°C. Six Romanian stores in one chain reported abnormal temperatures, suspected to be the result of a cyberattack.
According to DNSC director Dan Cîmpean, speaking to Libertatea, temperatures in the six Romanian stores rose around 1.30am. Staff discovered the problem around 8am. The refrigeration controllers were accessible from the internet through GSM routers and used older software. He said the incident had not spread to other IT infrastructure.
That distinction should trouble every board. A contained IT incident can still threaten a commercial operation. The damage does not have to spread across the network when the compromised device already controls something essential.
Reuters reported affected retailers in Belgium, Luxembourg, and Sweden, as well as refrigeration problems at 13 SuperValu stores in Ireland. Products were removed from sale. That reporting did not establish the attackers' identity or any connection to similar incidents in France in October.
The immediate loss is visible in discarded stock. The wider exposure emerges when customers ask whether products are safe, suppliers need revised instructions, and staff have to explain gaps on the shelves. A technical failure has become a management test.
Cyber preparedness belongs on the board agenda.
The UK’s current Be Ready guidance asks households to keep three days' worth of food and water. France recommends a 72-hour emergency kit. Germany’s civil protection authority advises being able to manage independently for ideally ten days, while recognizing that three days is a useful start.
For business leaders, the implication is practical: a cyber response cannot assume that normal access to essential services will remain available. An attack on a supplier can become your continuity problem without the attacker ever entering your own systems.
The European Commission’s preparedness strategy places conflict, sabotage, cyber threats, and vulnerable supply chains within the same wider risk environment. It calls for preparation across society, including businesses. A board does not need to predict whether the next interruption begins with an attack, an infrastructure failure, or a supplier’s collapse to examine the consequences.
A Romanian company may have functioning offices, while a foreign supplier cannot dispatch, a logistics partner loses systems, or a customer suspends orders. Employees may be dealing with disruption at home while the business assumes they remain available. Exposure extends beyond the equipment and people you directly control.
Lighthouse PR’s risk assessment helps leadership examine where operational weaknesses could become serious commercial and reputational problems. The useful question is specific: which interruption would prevent this business from meeting an obligation it cannot afford to break?
Obama put a cyber catastrophe on screen. Retailers are counting real losses.
Barack and Michelle Obama executive-produced Leave the World Behind, the Netflix thriller in which a cyberattack unravels ordinary life. The film is fiction, adapted from Rumaan Alam’s novel.
Refrigeration attacks offer a more immediate reason to pay attention. Cyber disruption can cross into the physical world, leaving products unusable and customers waiting for answers. No cinematic catastrophe is required.
A successful attack on refrigeration does not prove that the same attacker can disable Europe’s electricity system. It does expose a dangerous assumption: that cybersecurity concerns mainly involve stolen information, locked files, or unavailable websites. Connected equipment can change what physically happens inside a business.
Restoring IT does not reverse the damage.
Restoring data cannot recover spoiled food. Nor can a generator correct malicious temperature settings. Safeguards must match the failure, and the people responsible must recognize when normal operation can no longer be trusted.
That is why business continuity planning must connect technical recovery with operating decisions. Leadership needs to know what can continue safely, what must stop, and which alternatives are actually available. Cybersecurity, engineering, food safety, and legal specialists establish the facts within their disciplines. The wider plan must turn those facts into executable decisions.
Lighthouse PR brings those requirements into the leadership and communication response. If one team isolates equipment while another promises uninterrupted service, the organization creates its next problem.
Prepared crisis management gives someone authority to resolve that conflict. Waiting for the usual approval chain while stock deteriorates or customers receive contradictory instructions makes the response part of the loss.
A cyberattack creates a communication crisis before the investigation is finished.
Once a cyberattack is visible, customers want to know what it means for them. Is the product safe? Is their order affected? Has information been exposed? Technical teams may still be investigating while those questions are already being asked publicly. The company needs answers grounded in what has actually been established.
An assurance that everything is under control becomes dangerous if nobody has checked what is being sold or delivered. Silence leaves the same questions unanswered. Effective crisis communication establishes what can be confirmed, what remains under investigation, and when the next update will follow.
Lighthouse PR’s stakeholder communication connects those answers with the people who need them. Employees require usable instructions before facing customers. Commercial partners need a reliable account of commitments. Where authorities require information, the response must reflect the verified position.
For Romanian subsidiaries, this also means giving headquarters a clear account of local conditions. A group statement cannot answer a Romanian customer’s question unless the local facts support it.
Discover the weakness before your customers do.
Run the test before the incident. Lighthouse PR’s crisis preparedness work can put leadership through a simulation in which information is incomplete, an operational decision cannot wait, and a public question demands an answer. The exercise should reveal whether the right people can act together under pressure.
Crisis recovery then addresses what happens after systems return: outstanding commitments, damaged relationships and the evidence customers need before trusting the business again. Switching equipment back on does not settle those obligations.
Contact Lighthouse PR’s senior team for a confidential review of your crisis and continuity arrangements. Identify the decisions that would stall, the dependencies nobody owns, and the customer promises your current plan cannot protect.
Do not wait for a cyberattack to expose a plan that depends on everything still working. Your next management meeting should establish how the business will decide, operate, and communicate when the attacker removes normal conditions.
———
About the Author
Ana Maria Gardiner is a senior communications executive, board-level adviser, and founder of Lighthouse PR. With extensive experience advising multinational organizations and leadership teams, she brings expertise in corporate reputation, public relations, marketing communications, crisis management, and high-stakes communications.
Throughout her career, Ana Maria has led and implemented communications strategies for organizations including JPMorgan, Coca-Cola, ExxonMobil, Siemens Energy, HEINEKEN, Carrefour, Lexus, Franklin Templeton, BNP Paribas, Sungrow, XTB, Bitget, EssilorLuxottica, and Pfizer. Her experience spans the Middle East, North Africa, and Central and Eastern Europe, across a broad range of industries and business environments.
She works closely with senior executives and board-level decision-makers, advising Lighthouse PR clients on reputation management, strategic positioning, communications risk management, and developing responses to sensitive situations and crises.
Ana Maria holds a bachelor’s degree in Political Science and a master’s degree in European Affairs.
About Lighthouse PR
Lighthouse PR is an independent public relations and strategic communications consultancy headquartered in Bucharest, working with organizations across Romania, Central Europe, and South-Eastern Europe. The agency provides senior-led counsel to companies operating in financial services, energy, manufacturing, technology and cybersecurity, transport and logistics, retail, and FMCG.
Its portfolio of services includes media relations, corporate communications, reputation management, crisis communications, crisis preparedness and response, stakeholder and investor communications, social media and influencer management, B2B communications, risk assessments, business continuity planning, resilience framework development, media buying, corporate events, and SEO and website design services.
Lighthouse PR holds ISO 9001 and ISO 27001 certifications and is the exclusive representative for Romania and the Republic of Moldova of Eurocom Worldwide and Crisis Communication Network Europe, two international networks that strengthen the agency’s capacity to manage communications projects and crises with regional and international dimensions.
Through its consultancy model, Lighthouse PR places senior expertise at the heart of every client relationship, from strategy development and reputation management to implementing communications programs and coordinating responses in sensitive situations.
Lighthouse PR: Clear. Concise. Convincing.
