Key takeaway

Cyber incidents affecting commercial refrigeration systems in Europe demonstrate that an intrusion can disrupt not only information but also physical stock and day-to-day business operations. Recent European threat assessments also highlight ransomware, social engineering and reliance on interconnected service providers. In Georgia, the most meaningful business question is whether critical activities can continue when a digital system becomes unavailable, rather than simply whether a company has installed security software.

Three key findings

• EU authorities confirmed on 4 November that cybersecurity incidents had affected commercial refrigeration systems in multiple Member States since 11 October, with a further wave on 1–2 November. This does not establish a corresponding loss to Georgian companies.
• Geostat recorded internet access among 94.9% of enterprises in Georgia in 2025, while 15.3% used a website. Neither measure can be used as a proxy for the effectiveness of cybersecurity controls.
• BTU’s assessment is that business continuity, recovery arrangements and governance of external technology providers must be considered alongside conventional data-security precautions.

Cybersecurity is often reduced to the protection of passwords, computers and customer records. Each of those matters, but the economic consequences of an incident increasingly reach well beyond them. A retailer’s payment systems, warehouse software, delivery platform and even physical refrigeration equipment may depend on connected technology. When a critical component fails, employees cannot work normally and customers may no longer receive the promised service.

European incidents in October and early November 2026 provide a striking illustration. Cyber disruptions affected commercial refrigeration controls in several countries and led some retailers to discard spoiled goods. It would be wrong to infer that Georgian stores suffered the same losses: no such direct causal link has been established here. The incident instead demonstrates the mechanism through which compromised digital controls can create a tangible operational loss.

Why a technical incident becomes a management problem

Digital systems are not equally important to a company. A simple interruption to a noncritical application may be inconvenient. Failure of order processing, payment confirmation or stock records can prevent a business from completing transactions. The economic impact depends on the process that stops, the duration of the interruption and how much can be handled through alternative channels.

Connected operational technology creates a different exposure. In warehouses, production sites and food retailers, software may manage temperature, machinery or utilities. Remote monitoring improves efficiency and enables service providers to diagnose faults, but it also extends the list of credentials, interfaces and vendors that must be governed. A company that outsources maintenance still needs to understand who can access critical equipment and what happens when a system cannot be reached.

Connectivity does not make every device insecure. Actual risk depends on access restrictions, patching, configuration, oversight and recovery plans. That is why it would be misleading to classify an entire Georgian industry as vulnerable on the basis of a foreign event. The relevant lesson is to identify critical dependencies before an incident reveals them.

What the international evidence establishes

ENISA’s September 2026 threat assessment, which reviews events observed during 2025, identifies ransomware as one of the most consequential short-term threats and emphasises the role of interconnected digital dependencies. The report also describes phishing, denial-of-service campaigns, exploitation of vulnerabilities and the potential misuse of artificial intelligence by malicious actors. These are findings about the monitored European environment; they are not statistics on the number or success rate of attacks against Georgian firms.

The European Commission and cybersecurity authorities confirmed on 4 November that multiple Member States had experienced incidents involving commercial refrigeration and similar devices since 11 October. A fresh wave occurred on 1–2 November. The official statement described coordinated investigation and information sharing, and urged exposed organisations to take mitigating action. It did not establish a final attribution of responsibility to a particular state or group.

Financial services illustrate another channel of business impact. Compromised identities, payment processes and customer-facing services can interrupt transactions or undermine trust. Cases involving deception and fraudulent communication differ from the operational-technology incidents affecting freezers. Their common lesson is that digital failures can become customer-service, operational and reputational problems at the same time.

The Georgian enterprise landscape encompasses very different forms of digital dependence. One company may sell almost exclusively through social networks, another may use an external accounting and inventory platform, and a third may depend on booking software or electronic payments. A single connectivity rate cannot reveal which of these operations is vulnerable. The relevant question is where a digital system has become essential to delivering a service or completing a sale.

Georgia: widespread internet access is not the same as resilience

Geostat’s 2025 enterprise ICT survey reports that 94.9% of Georgian enterprises had internet access, 74.7% used fixed-line connectivity, 15.3% used a website and 25.8% used at least one social-media tool. These measures describe distinct aspects of digital adoption. They do not report the share of businesses with tested backups, incident-response plans, secure vendor access or reliable service-recovery processes.

The indicators should not be added together or interpreted as a composite cybersecurity index. The survey establishes the prevalence of certain ICT tools, not their security. A microenterprise may depend on a small number of essential services, whereas a large distributor may have integrated systems for inventory, finance and logistics. Their investment needs and consequences of downtime therefore differ.

Two conclusions should be avoided. A relatively low share of companies with websites does not mean other companies are insulated from cyber risk: email, payment systems and outsourced business software can be crucial without a public website. Conversely, near-universal internet access does not establish that every industrial device is directly exposed online. A meaningful assessment must identify actual systems, relevant business tasks and the people or vendors with access to them.

What can a Georgian firm actually lose?

An incident may stop sales, obstruct access to records, disrupt deliveries, require emergency technical support or temporarily prevent staff from serving customers. In some operations it may also damage physical goods. These effects must be considered separately: delayed orders do not necessarily become permanently lost revenue, and a disrupted service does not always imply a data breach.

For example, an online merchant that cannot process orders for a day may fulfil some of those orders later. Others may be cancelled or transferred to competitors. Calculating the actual financial effect requires order histories, cancellations, variable costs, restoration time and customer behaviour. No such verified company-level information is supplied here. A single national estimate of losses to Georgian business would therefore be invented.

The key exposure can be particularly consequential for businesses with short delivery windows, perishable goods, concentrated supplier relationships or little cash buffer. A hotel booking system, a freight operator’s documentation platform, a clinic’s administrative software and a retailer’s checkout service pose different operational risks. What unites them is the need to determine which functions must be restored first.

Consider a small illustrative Georgian retailer that receives requests through social media, tracks stock in an external application and uses a separate payment service. If the stock system becomes unavailable, the business may be unable to confirm availability or give a reliable delivery date. This is a hypothetical business workflow, not evidence of a recorded Georgian attack. It illustrates how a missing software function can immediately become a customer-service problem even when physical inventory is still on the premises.

The supplier can become the point of failure

Many companies use outside providers for accounting software, cloud storage, ordering systems, payment services and maintenance of connected machinery. Outsourcing may improve technical quality, but it does not erase dependence. An outside provider may control credentials, updates and a recovery process on which several businesses rely.

Vendor evaluation must therefore go beyond price and advertised functionality. Businesses should establish who owns and stores data, who maintains backups, how access is restricted, how quickly incidents are reported, and whether a workable alternative exists if the service is unavailable. These are practical questions for small companies as well as large ones.

The appropriate response is not to demand that every firm build its own technology stack. Rather, it is to make roles and recovery responsibilities explicit before a disruption. A well-drafted service agreement and a rehearsed fallback procedure can be more valuable than a vague promise of complete protection.

Smaller companies may not employ a dedicated cybersecurity team. Their first management questions can therefore be practical: which process stops first, who must be contacted and how long can the company continue to serve customers using an approved temporary procedure? Answers will not replace a technical security assessment. They can, however, help define the right scope for a provider review and a realistic continuity plan.

Policy developments and business responsibilities

Georgia approved a cybersecurity-awareness strategy for 2025–2030 in August 2025, aimed at improving knowledge and skills in both the public and private sectors. The Digital Governance Agency also provides information about incident response, training and cybersecurity services. These are relevant institutions and programmes, not evidence that Georgian enterprises have uniformly achieved a specific cybersecurity standard.

The EU regulatory context is evolving. Its 4 November statement notes that reporting requirements for certain serious incidents and exploited vulnerabilities under the Cyber Resilience Act took effect on 11 September 2026, while the Act’s principal cybersecurity requirements are scheduled to apply from 11 December 2027. These rules do not automatically impose identical obligations on all businesses in Georgia. Applicability depends on the entity, product, jurisdiction and legal relationship.

For Georgian buyers of technology, the issue is often practical: what support and security updates does a product have, who can reach it remotely, and what happens when the vendor stops maintaining it? A low purchase price may hide future replacement costs or dependence on discontinued software. Security review is therefore part of procurement and strategic risk management.

The size of a financial loss also depends on timing and the outcome after recovery. A delayed order is not necessarily a cancelled sale, and an application outage does not always stop every business function. Firms need separate records of deferred orders, actual cancellations, recovery expenditure and extra customer-service work. Without such company-level evidence, translating reported losses abroad into a national Georgian cost figure would be misleading.

What decision-makers should do

A useful starting point is mapping the services without which revenue, fulfilment or customer care would stop. The business can then identify essential systems, responsible employees and external providers. This creates a basis for prioritising controls without assuming that every enterprise needs the same budget or technology.

Next come practical disciplines: limiting privileges, using multifactor authentication where available, testing the restoration of backups, keeping essential systems updated, and training staff to identify suspicious requests. Critical functions also need alternative procedures. If an ordering platform fails, can a business still record requests and communicate delivery commitments? Such contingencies should be tested, not merely recorded in a policy.

BTU’s analytical assessment is that management should judge cybersecurity by the ability to identify disruption early, sustain essential activity and restore service, rather than by the number of products purchased. The European incidents are a warning about dependencies, not a verified forecast of losses in Georgia. A firm that understands those dependencies can make a more grounded resilience investment decision.

The clearest lesson for Georgia is consequently managerial rather than statistical. Cybersecurity should be judged by the business’s ability to notice disruption, preserve its most critical service and recover safely. European incidents cannot establish the magnitude of Georgian cyber losses, but they offer a concrete reason to check dependencies before a failure occurs.

Questions and answers

Did the European attacks also damage Georgian companies?
No direct loss in Georgia is established by the reviewed evidence. The incidents illustrate a type of exposure that Georgian companies may need to evaluate.

Does 94.9% measure cybersecurity readiness?
No. It is the 2025 share of enterprises with internet access, not a measure of security controls or successful recovery capability.

Where should a small enterprise begin?
Identify essential processes, review who has access, test backups and agree on procedures for temporary service disruption.

Can cyber losses be estimated precisely in advance?
Only with transparent assumptions and company-specific operational and financial data; imported industry averages cannot reliably establish a Georgian company’s loss.

Prepared by the academic team of Business and Technology University and the BTUAI Research Team, Tbilisi, Georgia.

Main sources: Joint statement by the European Commission and ENISA (4 November 2026); ENISA Threat Landscape 2026; Geostat enterprise ICT statistics (2025); Digital Governance Agency of Georgia. Full source URLs are provided in the Data sources field below.