Default Credentials and Vulnerable OT Software Leave European Refrigeration Systems Open to Sabotage
Threat actors — likely pro-Russian hacktivist groups — exploited suspected default credentials and unpatched software to gain control of industrial refrigeration controllers across European supermarkets and medical facilities, switching them to defrost mode and causing widespread food spoilage and potential harm to temperature-sensitive medical supplies. This attack highlights a chronic failure in operational technology (OT) security: internet-exposed industrial control systems are routinely left with factory-default passwords and unpatched firmware, making them trivial targets. The consequences extend well beyond IT disruption — compromised OT systems can directly harm public health and critical supply chains. As hacktivists increasingly target physical infrastructure to cause visible societal impact, the security baseline for OT environments must rise significantly.
Tactical Insight
Immediate actions
- Audit all internet-facing OT/ICS controllers and immediately change any default or weak credentials to strong, unique passwords.
- Isolate refrigeration control systems from the public internet using firewalls or VPNs, permitting remote access only through authenticated, monitored channels.
- Apply all available firmware and software patches to refrigeration controllers and associated management platforms.
Long-term improvements
- Implement network segmentation to place OT/ICS devices on dedicated, air-gapped or strictly firewalled network segments separate from corporate IT.
- Maintain a continuously updated asset inventory of all OT devices, including firmware versions, to enable rapid vulnerability identification and patching.
- Establish vendor relationships and patch notification processes specifically for industrial control system components used in critical infrastructure.
Detection measures
- Deploy OT-aware monitoring solutions to alert on anomalous controller commands, such as unexpected mode changes (e.g., defrost activation outside scheduled windows).
- Enable centralised logging of all authentication attempts and configuration changes on refrigeration controllers and forward logs to a SIEM for real-time analysis.
- Conduct regular penetration tests and red team exercises targeting OT environments to identify exploitable misconfigurations before attackers do.