[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAPxS6QuH0H9keVvqh6HF385Nn8dWNdC7F6WxSBNiaFA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"523b4ff9-7f83-4081-b3ee-b56684e65ae5","default-credentials-and-vulnerable-ot-software-leave-european-refrigeration-systems-open-to-sabotage","b973ec91-ac1b-4710-8389-833b75f6c974","Default Credentials and Vulnerable OT Software Leave European Refrigeration Systems Open to Sabotage","Threat actors — likely pro-Russian hacktivist groups — exploited suspected default credentials and unpatched software to gain control of industrial refrigeration controllers across European supermarkets and medical facilities, switching them to defrost mode and causing widespread food spoilage and potential harm to temperature-sensitive medical supplies. This attack highlights a chronic failure in operational technology (OT) security: internet-exposed industrial control systems are routinely left with factory-default passwords and unpatched firmware, making them trivial targets. The consequences extend well beyond IT disruption — compromised OT systems can directly harm public health and critical supply chains. As hacktivists increasingly target physical infrastructure to cause visible societal impact, the security baseline for OT environments must rise significantly.","**Immediate actions:**\n- Audit all internet-facing OT\u002FICS controllers and immediately change any default or weak credentials to strong, unique passwords.\n- Isolate refrigeration control systems from the public internet using firewalls or VPNs, permitting remote access only through authenticated, monitored channels.\n- Apply all available firmware and software patches to refrigeration controllers and associated management platforms.\n\n**Long-term improvements:**\n- Implement network segmentation to place OT\u002FICS devices on dedicated, air-gapped or strictly firewalled network segments separate from corporate IT.\n- Maintain a continuously updated asset inventory of all OT devices, including firmware versions, to enable rapid vulnerability identification and patching.\n- Establish vendor relationships and patch notification processes specifically for industrial control system components used in critical infrastructure.\n\n**Detection measures:**\n- Deploy OT-aware monitoring solutions to alert on anomalous controller commands, such as unexpected mode changes (e.g., defrost activation outside scheduled windows).\n- Enable centralised logging of all authentication attempts and configuration changes on refrigeration controllers and forward logs to a SIEM for real-time analysis.\n- Conduct regular penetration tests and red team exercises targeting OT environments to identify exploitable misconfigurations before attackers do.",[12,13,14,15,16,17,18],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 7: Continuous Vulnerability Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","NIST SP 800-53 SI-2: Flaw Remediation","MITRE ATT&CK T1078: Valid Accounts",{"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1078: Valid Accounts":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"CIS Control 7: Continuous Vulnerability Management":23,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":24,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"European supermarket refrigeration and medical facility supply chains fall under NIS2 scope for essential and important entities; Article 21(2)(b) requires incident handling and security measures proportionate to the risk, including securing OT systems against exactly this type of sabotage.","Attackers likely leveraged default or compromised credentials to authenticate as legitimate users of the refrigeration controllers; T1078 specifically covers adversary use of valid accounts to gain initial access, underscoring the need to eliminate default credentials in OT environments.","SI-2 requires organisations to identify, report, and correct information system flaws within defined timeframes; applying this control to the refrigeration management software would have closed the vulnerability before attackers could exploit it.","Vulnerable software on the refrigeration controllers was a likely attack vector; CIS Control 7 mandates continuous scanning and timely remediation of vulnerabilities across all networked assets, including industrial control systems.","Unpatched and vulnerable software on internet-exposed controllers enabled this attack; A.8.8 requires timely identification and remediation of technical vulnerabilities, which would have reduced the exploitable attack surface.","The suspected use of default credentials is a classic misconfiguration; CIS Control 4 requires organisations to establish and enforce secure baseline configurations — including changing default passwords — on all assets, including OT controllers, before deployment.","Default credentials provided attackers with the access needed to change controller settings; this framework function requires organisations to manage identities and enforce strong authentication, directly preventing unauthorised access to critical OT systems.","published","2026-11-06T22:20:45.625587+00:00","2026-11-06T22:20:45.605+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Funit42.paloaltonetworks.com\u002Feuropes-refrigeration-systems-attacks\u002F","turning-up-the-heat-inside-the-attacks-on-europe-s-refrigeration-system-680490","Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration System",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":42,"name":43,"slug":44,"description":45,"color":46},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[49,53,57],{"slug":50,"name":51,"problem":52},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":54,"name":55,"problem":56},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":58,"name":59,"problem":60},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection."]