Malaysia's #1 Content Aggregator
Europe’s cooling-system cyber-attacks reveal national resilience can fail through the smallest, least-watched connection
5 Nov 2026 • 7:22 AM MYT
Twentytwo13
On Nov 3, Prime Minister Datuk Seri Anwar Ibrahim told the Dewan Rakyat that Malaysia is “certainly among those considered potential targets” of cyber-attacks.
Europe had shown what that could mean. Overnight on Nov 1–2, supermarkets in several countries found their refrigeration systems tampered with. In Belgium, cooling units were reportedly forced into defrost mode. In Ireland, one chain removed chilled and frozen stock from 13 stores. It followed an October attack in France in which, police said, cooling units at hundreds of supermarkets were driven to 50°C, causing fires and food losses.
No one has claimed responsibility. This was not about banks or personal data. Food was spoiled, shelves emptied and a continent reminded that cyber-attacks have physical consequences.
Malaysia has understandably framed cyber risk around banks, telecommunications and personal data. The Cyber Security Act 2024 (Act 854) is broader, designating 11 National Critical Information Infrastructure (NCII) sectors, including energy, water, healthcare, transport and agriculture.
Yet a statute names sectors; attackers target the controllers, sensors, contractors and remote connections inside them, many of which nobody regards as critical.
Six attacks nobody is rehearsing
These are hypothetical scenarios, not reported incidents, unless stated.
Cold chain. Compromised controllers could spoil stock across food depots, pharmaceutical warehouses and hospital cold rooms. This equipment is treated as facilities hardware, serviced by contractors with remote access, and seldom appears in a cyber risk register.
Losses might surface only once products are unsafe. In a tropical country, refrigeration is how food and medicine stay usable.
Water. Falsified sensor readings or altered chemical dosing at a treatment plant. In 2021, an intruder at Oldsmar, Florida, reportedly tried to raise sodium hydroxide levels; an alert operator reversed it.
Such systems are assumed isolated, yet remote monitoring often connects them. The consequence is public health risk and lost trust. Safety cannot depend on someone happening to be watching.
Industrial cooling. Overheating at a factory or data centre could trigger shutdowns rippling through production lines and digital services. Cooling is seen as plant engineering, not security. For a country courting data-centre investment, it is a strategic dependency.
Ports. Here Malaysia received a warning, not a hypothetical scenario. In September, a cyber incident at the Port of Tanjung Pelepas affected terminal operating systems and paused container operations before a phased restart. The hypothetical is a longer, multi-port outage delaying fuel, food and medical supplies. Automation is celebrated for efficiency; fallback procedures must be rehearsed too.
Building management. Systems controlling ventilation, access doors, environmental monitoring and fire-safety interfaces in hospitals are installed by integrators and seldom owned by the security team. Tampering could disrupt clinical areas or hinder evacuation.
Hospitals guard patient records; do they guard the air handling?
Energy and traffic cascades. Disrupting energy management systems could cut power to water pumping, mobile towers and cooling plants at once; manipulated traffic signals could then slow ambulances.
No single operator sees the whole chain, so none owns the risk.
The small door into the big house
Operational technology (OT), Internet of Things devices, cloud platforms, remote monitoring and artificial intelligence have erased the boundaries engineers once relied on. An attacker need not breach a national operator; a maintenance provider, contractor, remote-access link or vendor platform may suffice.
In Europe, some incidents have been tied to specific equipment models and, in Portugal, apparently an outside contractor, although accounts of the entry point differ. The lesson is that one seemingly minor system can unsettle several essential services at once.
Beyond compliance
The Act, in force since Aug 26, 2024, strengthened the National Cyber Security Agency (NACSA) and obliged designated NCII entities to assess risk, audit and report incidents.
That was overdue. But compliance is a floor, and obligations bind only designated entities; attackers ignore designations. The prime minister’s five areas of national preparedness, covering coordination, regular exercises and protection of critical infrastructure, point the right way.
Malaysia’s evolving national cyber security strategy must now carry that logic down to the plant floor. Resilience also demands asset visibility, OT-specific vulnerability management, supplier assurance, tested incident response and continuity plans that assume systems may have to run manually.
Much infrastructure is privately operated, so intelligence-sharing among NACSA, regulators and industry cannot be optional.
What must happen now
The government should extend visibility below designated entities to contractors and equipment suppliers, and run cross-sector exercises. Operators should inventory every connected asset, remove unnecessary remote access and rehearse manual operation.
Boards should demand the OT and supplier risk picture, not just IT metrics, and fund it. Technology providers and contractors should deliver secure-by-default products, abandon shared credentials and notify customers swiftly.
Ownership must extend beyond the CIO and CISO to engineers, facilities managers, procurement teams and business owners. And stress tests must assume simultaneous disruption of power, water, cooling, ports and communications, not an isolated IT outage.
A nation’s cyber resilience cannot be measured only by how well its banks, telecommunications providers or government databases are protected.
It is measured by whether water keeps flowing, electricity stays on, hospitals keep functioning, food keeps moving and ports keep operating when interconnected systems come under attack.
If a cyber-attack can disrupt the systems that keep Malaysia functioning, are we protecting the infrastructure that matters — or merely the infrastructure we have traditionally chosen to look at?
These are hypothetical scenarios, not reported incidents, unless stated.
Cold chain. Compromised controllers could spoil stock across food depots, pharmaceutical warehouses and hospital cold rooms. This equipment is treated as facilities hardware, serviced by contractors with remote access, and seldom appears in a cyber risk register.
Losses might surface only once products are unsafe. In a tropical country, refrigeration is how food and medicine stay usable.
Water. Falsified sensor readings or altered chemical dosing at a treatment plant. In 2021, an intruder at Oldsmar, Florida, reportedly tried to raise sodium hydroxide levels; an alert operator reversed it.
Such systems are assumed isolated, yet remote monitoring often connects them. The consequence is public health risk and lost trust. Safety cannot depend on someone happening to be watching.
Industrial cooling. Overheating at a factory or data centre could trigger shutdowns rippling through production lines and digital services. Cooling is seen as plant engineering, not security. For a country courting data-centre investment, it is a strategic dependency.
Ports. Here Malaysia received a warning, not a hypothetical scenario. In September, a cyber incident at the Port of Tanjung Pelepas affected terminal operating systems and paused container operations before a phased restart. The hypothetical is a longer, multi-port outage delaying fuel, food and medical supplies. Automation is celebrated for efficiency; fallback procedures must be rehearsed too.
Building management. Systems controlling ventilation, access doors, environmental monitoring and fire-safety interfaces in hospitals are installed by integrators and seldom owned by the security team. Tampering could disrupt clinical areas or hinder evacuation.
Hospitals guard patient records; do they guard the air handling?
Energy and traffic cascades. Disrupting energy management systems could cut power to water pumping, mobile towers and cooling plants at once; manipulated traffic signals could then slow ambulances.
No single operator sees the whole chain, so none owns the risk.
The small door into the big house
Operational technology (OT), Internet of Things devices, cloud platforms, remote monitoring and artificial intelligence have erased the boundaries engineers once relied on. An attacker need not breach a national operator; a maintenance provider, contractor, remote-access link or vendor platform may suffice.
In Europe, some incidents have been tied to specific equipment models and, in Portugal, apparently an outside contractor, although accounts of the entry point differ. The lesson is that one seemingly minor system can unsettle several essential services at once.
Beyond compliance
The Act, in force since Aug 26, 2024, strengthened the National Cyber Security Agency (NACSA) and obliged designated NCII entities to assess risk, audit and report incidents.
That was overdue. But compliance is a floor, and obligations bind only designated entities; attackers ignore designations. The prime minister’s five areas of national preparedness, covering coordination, regular exercises and protection of critical infrastructure, point the right way.
Malaysia’s evolving national cyber security strategy must now carry that logic down to the plant floor. Resilience also demands asset visibility, OT-specific vulnerability management, supplier assurance, tested incident response and continuity plans that assume systems may have to run manually.
Much infrastructure is privately operated, so intelligence-sharing among NACSA, regulators and industry cannot be optional.
What must happen now
The government should extend visibility below designated entities to contractors and equipment suppliers, and run cross-sector exercises. Operators should inventory every connected asset, remove unnecessary remote access and rehearse manual operation.
Boards should demand the OT and supplier risk picture, not just IT metrics, and fund it. Technology providers and contractors should deliver secure-by-default products, abandon shared credentials and notify customers swiftly.
Ownership must extend beyond the CIO and CISO to engineers, facilities managers, procurement teams and business owners. And stress tests must assume simultaneous disruption of power, water, cooling, ports and communications, not an isolated IT outage.
A nation’s cyber resilience cannot be measured only by how well its banks, telecommunications providers or government databases are protected.
It is measured by whether water keeps flowing, electricity stays on, hospitals keep functioning, food keeps moving and ports keep operating when interconnected systems come under attack.
If a cyber-attack can disrupt the systems that keep Malaysia functioning, are we protecting the infrastructure that matters — or merely the infrastructure we have traditionally chosen to look at?
