Back to the trend of the day: Hackers switched off the cold in hundreds of French supermarket fridges
Poly Rating · from the trend of the day

Cyber Attacks Causing Physical Damage: Top 9 (2000–2026)

In October 2026, attackers pushed French supermarket fridges to about 50 °C for six hours, and the spoiled food that stores threw away could not be restored from any backup.

  • No. 1: German steel mill blast furnace attack (2014)
  • 9 places

01Final list

The leading AIs each built their own list of ten independently. Here is one result that is easy to check: every place has a reason, a source, and the list of AIs that included it.

Order: from most to least AI agreement.

A bright badge means this AI put the entry on its list. A dim badge means it did not.

  1. 1

    German steel mill blast furnace attack (2014)

    A phishing email led to a blast furnace that could not be shut down normally. Germany's BSI called it 'massive damage', but the form and permanence of the damage were never published.

    Included it: Gemini, Claude, ChatGPT.

    In their lists: Gemini: 2 · Claude: 2 · ChatGPT: 6

    What each AI noted 3
    • Geminiplace 2

      Spear-phishing crossed from office IT into heavy metallurgy, leaving a blast furnace unable to shut down normally and resulting in massive, permanent structural damage.

      Source ↗
    • Claudeplace 2

      A phishing email in the office network ended with a blast furnace that could not be shut down normally, which the BSI called "massive damage".

      Source ↗
    • ChatGPTplace 6

      A blast furnace suffered massive physical damage after operators could not shut it down normally.

      Source ↗
    3 AIs put it here
    Source ↗
  2. 2

    Ukraine power grid attack (2015)

    About 225,000 customers lost power for 1–6 hours when breakers at 30 substations were opened remotely. Firmware on network converters was also overwritten.

    Included it: Gemini, Claude, ChatGPT.

    In their lists: Gemini: 9 · Claude: 5 · ChatGPT: 3

    What each AI noted 3
    • Geminiplace 9

      Attackers disconnected 30 substations and bricked serial-to-Ethernet converters with malicious firmware, forcing operators to pilot high-voltage grids by hand for months.

      Source ↗
    • Claudeplace 5

      About 225,000 customers lost power when attackers opened breakers at several substations by hand.

      Source ↗
    • ChatGPTplace 3

      About 225,000 customers lost power across three regional utilities for roughly 1–6 hours.

      Source ↗
    3 AIs put it here
    Source ↗
  3. 3

    Triton safety-system attack (Saudi petrochemical plant, 2017)

    Attackers reached the plant's last safety layer, but a coding bug tripped a safe shutdown. The plant stopped (about 10 days in one account) and nothing broke.

    Included it: Gemini, Claude, ChatGPT.

    In their lists: Gemini: 7 · Claude: 10 · ChatGPT: 8

    What each AI noted 3
    • Geminiplace 7

      The world's first malware specifically engineered to sabotage physical Safety Instrumented Systems (SIS), attempting to silence emergency safeguards at a petrochemical plant.

    • Claudeplace 10

      The attacker reached the safety controllers and a coding bug triggered a safe shutdown, so the plant stopped and no damage followed.

      Source ↗
    • ChatGPTplace 8

      Attackers reached safety instrumented controllers; the resulting shutdown reportedly kept the plant inoperable for about 10 days.

      Source ↗
    3 AIs put it here
    Source ↗
  4. More about the top three ↓
  5. 4

    French supermarket fridge attack (October 2026)

    Fridges ran at about 50 °C for six hours and spoiled stock was thrown away. Store counts disagree: 250–350 in one note, about 700 according to France's finance minister.

    Included it: Gemini, Claude, ChatGPT.

    In their lists: Gemini: 4 · Claude: 3 · ChatGPT: 2

    What each AI noted 3
    • Geminiplace 4

      Attackers forced hundreds of grocery refrigeration panels into continuous 50°C defrost cycles overnight, creating thousands of tonnes of spoiled food that backups could never restore.

    • Claudeplace 3

      Fridges were pushed to about 50 °C for roughly six hours in hundreds of stores, so spoiled stock was thrown away, and most affected controllers were models Danfoss no longer updates.

      Source ↗
    • ChatGPTplace 2

      Around 700 of France’s 10,000 supermarkets were reported affected, with several chains discarding perishable stock.

      Source ↗
    3 AIs put it here
    Source ↗
  6. 5

    Maroochy Shire sewage spill (Australia, 2000)

    Radio commands from a former contractor released raw sewage into parks and waterways: 264,000 to 1,000,000 litres depending on the source. A spill cannot be undone.

    Included it: Gemini, Claude, ChatGPT.

    In their lists: Gemini: 10 · Claude: 9 · ChatGPT: 4

    What each AI noted 3
    • Geminiplace 10

      A disgruntled contractor used a stolen radio transmitter to suppress SCADA alarms and pump 800,000 liters of raw sewage into public parks and canals.

      Source ↗
    • Claudeplace 9

      A former contractor with stolen radio gear disabled pump-station alarms, and the spill figure ranges from 264,000 to 1,000,000 litres depending on the source.

      Source ↗
    • ChatGPTplace 4

      Repeated radio commands released roughly 800,000 to 1,000,000 litres of untreated sewage into local waterways and public spaces.

      Source ↗
    3 AIs put it here
    Source ↗
  7. 6

    FrostyGoop heating attack in Lviv (Ukraine, 2024)

    About 600 buildings in Lviv lost heating for about 48 hours in January. The attack used plain Modbus commands sent to heating controllers.

    Included it: Gemini, Claude, ChatGPT.

    In their lists: Gemini: 8 · Claude: 8 · ChatGPT: 5

    What each AI noted 3
    • Geminiplace 8

      Attackers bypassed supervisory systems to inject raw Modbus commands into district heating controllers, cutting hot water and radiators to 600 residential buildings during freezing weather.

    • Claudeplace 8

      Malware speaking Modbus to heating controllers left residents of about 600 apartment buildings without heat in winter.

      Source ↗
    • ChatGPTplace 5

      More than 600 households lost heating and hot water for about 48 hours during winter.

      Source ↗
    3 AIs put it here
    Source ↗
  8. 7

    Industroyer blackout in Kyiv (Ukraine, 2016)

    Purpose-built grid malware cut power to part of Kyiv for about an hour (75 minutes according to ESET). No hardware loss was confirmed.

    Included it: Gemini, Claude, ChatGPT.

    In their lists: Gemini: 6 · Claude: 7 · ChatGPT: 7

    What each AI noted 3
    • Geminiplace 6

      Custom malware spoke native power grid protocols (IEC 60870-5-104) to open transmission breakers, cutting 200 MW in Kyiv and blowing optical hardware isolators.

    • Claudeplace 7

      Purpose-built grid malware cut Kyiv's power for nearly 75 minutes, and ESET called it the biggest ICS threat since Stuxnet.

      Source ↗
    • ChatGPTplace 7

      A substation outage left roughly one-fifth of Kyiv without power for about an hour; no comparable hardware loss was reported.

      Source ↗
    3 AIs put it here
    Source ↗
  9. 8

    Predatory Sparrow attack on Iranian steel plants (2022)

    Video showed molten steel and fire on the Khuzestan Steel floor, but the damage claim rests on the attackers' own footage. The plant said production continued.

    Included it: Gemini, Claude. Did not include: ChatGPT.

    In their lists: Gemini: 3 · Claude: 4

    What each AI noted 2
    • Geminiplace 3

      Hacktivists breached industrial control lines and forced heavy machinery into an uncontrolled surge that erupted in molten steel across the factory floor.

    • Claudeplace 4

      The group released video of molten steel spilling onto a foundry floor after workers had been cleared out, but the damage claim rests largely on the group's own footage.

      Source ↗
    2 AIs put it here
    Source ↗
  10. 9

    Fuxnet attack on Moscollector sensor network (Russia, 2024)

    A pro-Ukraine group claimed it destroyed sensor gateways that would need physical replacement. This is a single, unverified claim.

    Included it: Claude. Did not include: Gemini, ChatGPT.

    In their lists: Claude: 6

    What each AI noted 1
    • Claudeplace 6

      A pro-Ukraine group claimed it disabled thousands of sensors and destroyed the gateways that report from them, which hardware would have to replace.

      Source ↗
    1 AIs put it here
    Source ↗

02More about the top three

The ranking is above. Here is more about the three places at the top: what they are, why they are here, and what is worth knowing.

The three are measured differently: a furnace damaged, a blackout of customers, and a plant shut down with no damage, so the figures are not directly comparable.

1German steel mill blast furnace attack (2014)

No. 1 — German steel mill blast furnace attack (2014). On the lists of 3 of 3 AIs; median place there: 2. The AIs ranked it first because a phishing email ended with a blast furnace that could not be shut down and suffered 'massive damage'.

2014 by-David-Revoy
David Revoy · CC BY 4.0 · Wikimedia Commons

Did you know

  • One analyst guessed the real aim was industrial sabotage between competitors, and that the blast furnace was collateral damage. He called this an educated guess. No one has confirmed it.

    Source ↗
What it is
A 2014 attack on a German steel mill's blast furnace.
Its edge
It is the one of the three where equipment was actually damaged.
Who should know
Useful for anyone curious how an office email can wreck heavy machinery.
  • Physical harm from cyber attack'Massive damage' (BSI)

Wikipedia · Wikidata

Why it is here

  • One blast furnace suffered physical damage after attackers reached the mill’s production network. [INL case study](https://cyote.inl.gov/content/uploads/24/2025/12/CyOTE-Case-Study_Thyssenkrupp.pdf) — (voice only)

    Source ↗

  • The INL report estimates $4 million in furnace damage, giving this case a direct equipment-loss figure. [INL case study](https://cyote.inl.gov/content/uploads/24/2025/12/CyOTE-Case-Study_Thyssenkrupp.pdf) — (voice only)

    Source ↗
Did you know

  • Germany's BSI did not name the steel plant or say when the attack happened. It also said it did not know who was behind it or why. Even so, it rated the attacker's skills as "very advanced".

    Source ↗
History

  • In 2014, Germany’s BSI revealed that a cyberattack had left a blast furnace in an undefined state and caused what it called “massive damage.” The report did not name the mill or describe the damage further. — (voice only)

    Source ↗
Keep in mind

  • The steelworks was never named. The page says the full extent of the damage and its cost are unknown, and so is whether the furnace was repaired or returned to work.

    Source ↗ ✓ confirmed by several AIs
Where to go further

  • Open the BSI archive page and find the 2014 report, 'The State of IT Security in Germany'. Read the section on the steel plant, looking for the blast furnace case and the words 'massive damage'.

    Source ↗

Video: 2014, explained in 4 minutes · Vox

Compare the top three ↓

2Ukraine power grid attack (2015)

No. 2 — Ukraine power grid attack (2015). On the lists of 3 of 3 AIs; median place there: 5. The AIs placed it second because remote breaker attacks cut power to about 225,000 customers, though the outage was fairly short.

Did you know

  • While the power was out, the attackers also flooded the utility's customer phone lines with calls. Customers could not report the outage, and the call center was overloaded.

    Source ↗
What it is
A 2015 attack that switched off power at Ukrainian substations.
Its edge
It hit the most people, with a real blackout across several utilities.
Who should know
Useful for anyone who relies on electricity and wonders how fragile grids are.
  • Physical harm from cyber attack~225,000 customers lost power

Wikipedia · Wikidata

History

  • In 2015, crews restored power after attackers opened breakers across Ukrainian substations. With remote control unavailable, technicians went to the substations and operated the equipment by hand. — (voice only)

    Source ↗ ✓ confirmed by several AIs
Keep in mind

  • The blackout lasted about one to six hours. But the attackers overwrote firmware on some converters, and the page says re-flashing was needed months later. Power came back by switching breakers by hand.

    Source ↗

  • Recovery was slow for the hardest-hit companies. They spent months in "manual mode" because they could not trust their networks. At least three other energy firms stopped the hackers before any physical harm.

    Source ↗
Where to go further

  • Start with the description part of this CISA alert. It explains the December 2015 outages in Ukraine and that malware was found across several sectors. Check the 2021 revision date too.

    Source ↗
Compare the top three ↓

3Triton safety-system attack (Saudi petrochemical plant, 2017)

No. 3 — Triton safety-system attack (Saudi petrochemical plant, 2017). On the lists of 3 of 3 AIs; median place there: 8. The AIs ranked it third because attackers reached the safety system, but a bug caused a safe shutdown and no damage.

Did you know

  • Mandiant said, with moderate confidence, that the attacker was building the ability to cause physical damage. The shutdown that exposed the intrusion was accidental. It was not the plan.

    Source ↗
What it is
A 2017 attack on safety controllers at a Saudi petrochemical plant.
Its edge
It is the only one that went after the safety system meant to stop disasters.
Who should know
Useful for anyone who wants to know how close a plant came to danger.
  • Physical harm from cyber attackNo damage; ~10 days offline
Why it is here

  • The malware triggered safety shutdowns in six controllers, reaching the plant’s safety layer. The shutdown prevented a worse physical outcome, but the attack still disrupted the refinery. [INL case study](https://cyote.inl.gov/content/uploads/24/2025/12/CyOTE-Case-Study_TRITON.pdf) — (voice only)

    Source ↗

  • The refinery was inoperable for 10 days after the shutdown, though the incident caused no physical damage. [INL case study](https://cyote.inl.gov/content/uploads/24/2025/12/CyOTE-Case-Study_TRITON.pdf) — (voice only)

    Source ↗
Did you know

  • Triton is described as the first malware built to attack an industrial plant's safety systems. These are the controllers whose job is to shut a process down when conditions turn dangerous.

    Source ↗
History

  • In 2017, an accidental trip of a safety controller was first blamed on mechanical failure. When a later shutdown led to an investigation, responders found the Triton malware; the plant was back online 10 days after the August shutdown began. — (voice only)

    Source ↗
Keep in mind

  • Accounts differ on why the plant stopped. One database says two of three safety controllers entered a failed state. Another says the attackers accidentally powered the system down.

    Source ↗

  • The first safety-system trip, in June 2017, halted the plant and was wrongly blamed on a mechanical fault. Several systems tripped again in August 2017. The article does not say how long the plant was down.

    Source ↗
Where to go further

  • Open the MITRE ATT&CK page for the Triton tool and read its description. Then look for the campaign C0030 entry to see how a bug in the attackers' code caused the safety trip.

    Source ↗
Compare the top three ↓

The top three side by side

German steel mill blast furnace attack (2014)Ukraine power grid attack (2015)Triton safety-system attack (Saudi petrochemical plant, 2017)
In the AIs' lists3 / 33 / 33 / 3
Physical harm from cyber attack'Massive damage' (BSI)~225,000 customers lost powerNo damage; ~10 days offline
Put first by———

Places with the same number of AIs are ordered by their average place in the AIs' own lists.

More ratings

03Worth knowing

What the AIs noticed while building the list.

Ukraine's 2015 blackout was fixed in hours, but Stuxnet's lost centrifuges could not be restored from any software backup.

Noticed by:
Included it: ChatGPT. Did not include: Gemini, Claude.
Source ↗

The French fridge attack needed no new malware. Reports say it triggered Danfoss's built-in defrost function on controllers that no longer get updates.

Noticed by:
Included it: Gemini, Claude. Did not include: ChatGPT.
Source ↗

FrostyGoop (Modbus) and Industroyer (IEC-104) worked by sending ordinary control commands, not by running exotic malware on the controller.

Noticed by:
Included it: Gemini, ChatGPT. Did not include: Claude.
Source ↗

Waterfall counted 57 attacks with physical consequences in heavy industry in 2025, 25% fewer than in 2024, and expects the number to rise again.

Noticed by:
Included it: Claude. Did not include: Gemini, ChatGPT.
Source ↗

Two near-misses are not on the list. Destructive malware hit Polish energy sites in December 2025, including a heat plant serving nearly 500,000 customers, with no supply cut. Industroyer2 (2022) was stopped before any outage.

Noticed by:
Included it: ChatGPT. Did not include: Gemini, Claude.
Source ↗

04Questions people ask

Can a cyber attack cause physical damage?

Yes. During the Stuxnet period, IAEA cameras saw about 900–1,000 Iranian centrifuges removed. In 2014 an attack left a German blast furnace with what the BSI called 'massive damage'.

Can a cyberattack cause physical harm?

Yes, to physical processes. Maroochy released up to 1,000,000 litres of raw sewage, and Lviv lost heating in about 600 buildings for two days. No confirmed deaths were found in these cases.

Source ↗
What cyberattack caused physical damage in 2026?

In October 2026, attackers pushed French supermarket fridges into a defrost at about 50 °C for six hours in hundreds of stores, and the spoiled stock was thrown away.

Source ↗
Why do damage figures differ between sources?

Many figures are estimates or come from separate accounts. For example, the Maroochy spill is quoted as 264,000, 800,000 or 1,000,000 litres.

Source ↗

05How we counted

In plain words, no formulas.

1The question

Top 10 Cyberattacks That Did Physical Damage in the Real World

2Why this topic

People look up whether a cyberattack can cause physical harm all year round, and no single list ranks the cases by how much of the damage could never be reversed.

3Where it applies

Global industrial control systems and civilian infrastructure, from Stuxnet to 2026. Attacks that only encrypted office IT are excluded.

4What we looked at

  • The intrusion directly changed a physical process or machine: equipment destroyed, a process pushed out of safe limits, or goods spoiled and thrown away
  • Time needed to recover physically (replace hardware, dispose of stock) compared with the time needed to restore the software and network
  • Scale of the physical effect: machines, customers, stores or tonnes affected
  • Depth of control reached (sensor and actuator level vs. supervisory override), as classified in OT incident reporting
  • CSIS Significant Cyber Incidents — Dated timeline of high-consequence cyber events; useful for finding cases, but it is not a complete inventory of physical effects
  • Dragos OT Cybersecurity Year in Review — Which OT threats reached physical process control (e.g. FrostyGoop, Fuxnet) and how deep they went
  • CISA ICS advisories — Technical confirmation of which industrial controllers were exploited; technical reach alone does not prove physical harm
  • Waterfall Security 2026 OT Cyber Threat Report — Count of attacks with physical consequences in heavy industry: 57 in 2025, down 25% from 2024

5Who ranked

The leading AIs, each building its own list of ten independently and naming a source for every place: Gemini, Claude, ChatGPT.

6How the places were set

The same entry written differently by different AIs was counted as one. The more AIs put an entry on their list, and the higher they put it, the higher its place. "AI agreement" shows how many of the AIs had it on their own list. Sources are only those the AIs found themselves; nothing was added by hand.

06Each AI's own list

🇺🇸 Gemini10 places · 1 notes

The same question, answered by Gemini alone. The final list above combines all the AIs.

  1. 1
    Stuxnet Centrifuge Sabotage (Iran, 2010)

    Software took days to analyze, but over 984 uranium centrifuges physically tore themselves apart, setting Iran's enrichment program back by an estimated two years.

  2. 2
    German Steel Mill Blast Furnace Melting (Germany, 2014)

    Spear-phishing crossed from office IT into heavy metallurgy, leaving a blast furnace unable to shut down normally and resulting in massive, permanent structural damage.

    Source ↗
  3. 3
    Khouzestan Steel Factory Meltdown by Predatory Sparrow (Iran, 2022)

    Hacktivists breached industrial control lines and forced heavy machinery into an uncontrolled surge that erupted in molten steel across the factory floor.

  4. 4
    French Supermarket Commercial Refrigeration Sabotage (France, 2026)

    Attackers forced hundreds of grocery refrigeration panels into continuous 50°C defrost cycles overnight, creating thousands of tonnes of spoiled food that backups could never restore.

  5. 5
    Viasat KA-SAT AcidRain Firmware Bricking (Europe, 2022)

    A destructive wiper permanently overwrote flash memory in tens of thousands of satellite terminals, physically disabling 5,800 wind turbines in Germany within hours.

    Source ↗
  6. 6
    Industroyer / CRASHOVERRIDE Substation Strike (Ukraine, 2016)

    Custom malware spoke native power grid protocols (IEC 60870-5-104) to open transmission breakers, cutting 200 MW in Kyiv and blowing optical hardware isolators.

  7. 7
    Triton / TRISIS Safety System Override (Saudi Arabia, 2017)

    The world's first malware specifically engineered to sabotage physical Safety Instrumented Systems (SIS), attempting to silence emergency safeguards at a petrochemical plant.

  8. 8
    FrostyGoop Municipal Heating Network Freeze (Ukraine, 2024)

    Attackers bypassed supervisory systems to inject raw Modbus commands into district heating controllers, cutting hot water and radiators to 600 residential buildings during freezing weather.

  9. 9
    Ukrainian Regional Blackout & Firmware Erasure (Ukraine, 2015)

    Attackers disconnected 30 substations and bricked serial-to-Ethernet converters with malicious firmware, forcing operators to pilot high-voltage grids by hand for months.

    Source ↗
  10. 10
    Maroochy Shire Sewage Pumping Sabotage (Australia, 2000)

    A disgruntled contractor used a stolen radio transmitter to suppress SCADA alarms and pump 800,000 liters of raw sewage into public parks and canals.

    Source ↗

What Gemini noticed

Cyber recovery from a pure data breach is measured in server re-imaging times, but physical attacks create irreversible thermodynamic losses: thousands of tonnes of melted meats and dairy cannot be recovered from any digital backup.

Source ↗
🇺🇸 Claude10 places · 4 notes

The same question, answered by Claude alone. The final list above combines all the AIs.

  1. 1
    Stuxnet (Iran, Natanz, 2010)

    Destroyed roughly 1,000 centrifuges (about 10% of the operating stock) by changing their speed, and ran for over a year before anyone saw it was a cyberattack.

    Source ↗
  2. 2
    German steel mill blast furnace attack (2014)

    A phishing email in the office network ended with a blast furnace that could not be shut down normally, which the BSI called "massive damage".

    Source ↗
  3. 3
    French supermarket fridge defrost attack (October 2026)

    Fridges were pushed to about 50 °C for roughly six hours in hundreds of stores, so spoiled stock was thrown away, and most affected controllers were models Danfoss no longer updates.

    Source ↗
  4. 4
    Predatory Sparrow vs Iranian steel plants (2022)

    The group released video of molten steel spilling onto a foundry floor after workers had been cleared out, but the damage claim rests largely on the group's own footage.

    Source ↗
  5. 5
    Ukraine power grid attack (2015)

    About 225,000 customers lost power when attackers opened breakers at several substations by hand.

    Source ↗
  6. 6
    Fuxnet sensor-gateway attack on Moscollector (Russia, 2024)

    A pro-Ukraine group claimed it disabled thousands of sensors and destroyed the gateways that report from them, which hardware would have to replace.

    Source ↗
  7. 7
    Industroyer / Kyiv blackout (2016)

    Purpose-built grid malware cut Kyiv's power for nearly 75 minutes, and ESET called it the biggest ICS threat since Stuxnet.

    Source ↗
  8. 8
    FrostyGoop heating outage in Lviv (Ukraine, January 2024)

    Malware speaking Modbus to heating controllers left residents of about 600 apartment buildings without heat in winter.

    Source ↗
  9. 9
    Maroochy Shire sewage attack (Australia, 2000)

    A former contractor with stolen radio gear disabled pump-station alarms, and the spill figure ranges from 264,000 to 1,000,000 litres depending on the source.

    Source ↗
  10. 10
    Triton safety-system attack (Saudi petrochemical plant, 2017)

    The attacker reached the safety controllers and a coding bug triggered a safe shutdown, so the plant stopped and no damage followed.

    Source ↗

What Claude noticed

Waterfall counted 57 attacks with real-world physical consequences in heavy industry in 2025, 25% fewer than in 2024. Waterfall attributes the fall mostly to temporary ransomware factors and expects it to rise again.

Source ↗

The October 2026 French fridge attack needed no new malware. Reports say it triggered Danfoss's built-in defrost function on controllers that no longer get updates.

Source ↗

Dragos's 2026 report says several threat groups, independently and across geopolitical alignments, are mapping control loops to learn how to disrupt physical processes.

Source ↗

The 2014 German steel mill case was described by reporters as only the second confirmed case of a purely digital attack causing physical destruction, after Stuxnet.

Source ↗
🇺🇸 ChatGPT10 places · 3 notes

The same question, answered by ChatGPT alone. The final list above combines all the AIs.

  1. 1
    Stuxnet at Natanz, Iran (2009–10)

    About 1,000 centrifuges may have been taken out of operation; the exact damage count remains disputed.

  2. 2
    French supermarket refrigeration attack (2026)

    Around 700 of France’s 10,000 supermarkets were reported affected, with several chains discarding perishable stock.

    Source ↗
  3. 3
    Ukraine power grid attack (2015)

    About 225,000 customers lost power across three regional utilities for roughly 1–6 hours.

    Source ↗
  4. 4
    Maroochy Shire sewage spill, Australia (2000)

    Repeated radio commands released roughly 800,000 to 1,000,000 litres of untreated sewage into local waterways and public spaces.

    Source ↗
  5. 5
    FrostyGoop heating attack in Lviv, Ukraine (2024)

    More than 600 households lost heating and hot water for about 48 hours during winter.

    Source ↗
  6. 6
    German steel mill cyberattack (2014)

    A blast furnace suffered massive physical damage after operators could not shut it down normally.

    Source ↗
  7. 7
    Industroyer / Kyiv power outage, Ukraine (2016)

    A substation outage left roughly one-fifth of Kyiv without power for about an hour; no comparable hardware loss was reported.

    Source ↗
  8. 8
    Triton / Trisis at a Saudi petrochemical plant (2017)

    Attackers reached safety instrumented controllers; the resulting shutdown reportedly kept the plant inoperable for about 10 days.

    Source ↗
  9. 9
    Polish energy infrastructure cyberattack (2025)

    Destructive malware hit renewable sites and a CHP plant serving nearly 500,000 customers, but electricity and heat service continued.

    Source ↗
  10. 10
    Industroyer2 attempt against Ukraine’s grid (2022)

    The malware was stopped before it caused a reported outage, so its demonstrated physical harm is below the incidents above.

    Source ↗

What ChatGPT noticed

Recovery time is not the same as physical recovery: Ukraine’s 2015 outage lasted hours, while Stuxnet’s suspected centrifuge losses could not be reversed by restoring software.

Source ↗

FrostyGoop sent Modbus commands directly to heating controllers, showing that industrial effects can come from changing routine control settings rather than deploying spectacular destructive malware.

Source ↗

The French supermarket event adds spoiled inventory to the record of cyber-physical harm: software restoration cannot make discarded chilled or frozen food safe again.

Source ↗