In the early hours of Monday 2 November, the freezers in a Stockholm supermarket started to warm up. Nobody noticed for hours. By the time staff realised, the temperature inside had reached 50°C and the stock was ruined.

It wasn't a power cut or a mechanical fault. Someone had reached into the refrigeration controls over the internet and changed the settings.

That store was one of more than 115 hit that night across Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. It followed an attack in October on refrigeration at around 700 supermarkets in France.

When we wrote about the French incident at the time, our reading was that it was a textbook operational technology attack, and an unusual one. Operational technology, or OT, is the equipment that runs physical things: machines, controls, chillers, sensors. Most cyberattacks steal data or lock up computers. This one reached through the network and changed something in the physical world. A few weeks on, the same tactics are spreading across Europe.

At the time of writing, nobody yet knows who is behind it. No UK stores have been affected, and the National Cyber Security Centre is working with international partners and industry to understand what has happened.

This was never really just about fridges

Supermarkets aren't the point. The point is that equipment most people would never call "IT" was used to cause real, physical, expensive damage. The people running those stores could do little but bin the food and wait for an engineer.

The Black Country should recognise that picture more than most. This is a region that makes, finishes, stores and moves things. Walk round a typical site here, whether a press shop in Darlaston, a plating line in Willenhall or a distribution centre off the M6, and alongside the laptops and email you'll find a second technology estate: production machinery, furnace and oven controls, compressors, chillers, building management, CCTV, door access and environmental sensors.

Some of it talks to the internet. Some of it is looked after remotely by the firm that installed it. Some went in ten years ago and hasn't been thought about since, because it works. Very little of it comes to mind when a board asks how secure the business is.

There's a useful comparison with October's PHP2Shell flaws, which hit software behind a huge share of the world's websites and had IT teams everywhere checking and patching servers. That was serious, but it was clear whose problem it was. Connected equipment on a factory floor rarely comes with that clarity.

The question nobody owns

Here's where it gets uncomfortable. Ask who is responsible for that second estate and you'll often get several answers, or none.

IT runs the network but doesn't touch the machines. Operations relies on the machines but doesn't know how they're connected. Facilities commissioned the chillers and the access control. Engineering keeps the line running. A supplier dials in to maintain the controller. If there's a cyber lead, they may sit somewhere else again.

Every one of those people can be doing their job well, and the risk can still fall into the gap between them, because each reasonably assumes someone else has it covered. That isn't a technical failing. It's an accountability one, and accountability is what leadership is for.

The supermarket incidents show how quickly this stops being abstract. Once you can't trust the kit, the problem is stock, customers, suppliers, insurance and reputation, all at once. Nor is the fix always quick: one Belgian refrigeration installer said a proper repair meant physically modifying units as well as updating their software.

A better question for the boardroom

"Are we cyber secure?" is the question most boards ask, and it's almost impossible to answer honestly. Try this instead:

Which pieces of connected technology could seriously disrupt this business if we lost control of them tomorrow?

There's no universal checklist, and that's deliberate. A toolmaker in Cradley Heath and a cold store in Oldbury will need different questions. But these are good places to start:

• Legacy kit. What older equipment is still running, still connected, and perhaps still on the password it shipped with?
• Access. Could someone reach our systems or machinery remotely? Who can today, including suppliers, and how strong are the passwords and barriers in their way?
• Detection. Would we notice if someone changed a setting they shouldn't?
• Impact. What would actually happen to production, deliveries or customers if we couldn't use, or trust, a key system tomorrow?
• Our place in the supply chain. If we make parts for others, could our systems become a route into theirs, or could tampering with our kit affect what we ship?
• Our reliance on others. Which suppliers do we depend on, and how exposed are we if their systems are compromised?
• Ownership. For each of these, who in the business is accountable?

The list could go on. The point isn't to tick off someone else's checklist; it's to step back and work out the right questions for your business. If that means getting IT, operations, facilities, engineering and a supplier round the same table, the exercise hasn't gone wrong. That's probably the meeting that should have happened years ago.

You can outsource the maintenance, not the consequences

Most businesses quite rightly rely on specialists to install and look after equipment they couldn't maintain themselves. In France, supermarkets commonly hand refrigeration to third parties and have little say over how it is secured.

But if a supplier-managed system stops your line, locks you out of your building or ruins your stock, it's your business that carries the cost. So supplier access belongs in the risk conversation: who has it, how it's controlled, who reviews it, what happens when an engineer leaves the supplier, and how quickly you could cut it off in an incident.

"The supplier looks after that" is a reasonable place to start. It shouldn't be where the conversation ends.

No need to panic. Every reason to look.

Nothing here suggests an attack on a Black Country business is imminent. This is about learning from what's happening elsewhere while it's still someone else's problem.

The region's strength has always been its physical economy, and technology now runs right through it. That brings real gains in efficiency and insight. It also means our idea of cyber risk has to stretch beyond the office.

Nobody expects an MD to understand every sensor or read firewall rules. But leaders should know which technology the business depends on, who is accountable for it, who can reach it from outside, and whether the business could keep going if it failed.

Put the question on the agenda this week. The most important computer in your business may not look like a computer at all.

Concerned about your own operational technology?

As a proud Technology Partner of the Black Country Chamber of Commerce, Intercity is here to help businesses make technology easier, more productive and more secure, so you can focus on what matters most.

If this article has made you question what’s connected across your own business, who has access to it or how well protected your operational technology is, you don’t have to figure it out alone.