[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fW1TZOHdb_ltGF8Y-pizQe0AksiGPYaQX-YpjVH0i8Ns":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"c847f854-1658-4894-b22a-c7072f0db5e4","ics-refrigeration-controllers-exposed-to-internet-enable-supermarket-freezer-attacks","cbbd9557-5600-4f71-9f88-e35ea5b3b8de","ICS Refrigeration Controllers Exposed to Internet Enable Supermarket Freezer Attacks","Hackers exploited internet-exposed industrial control system (ICS) interfaces—specifically Danfoss and Copeland refrigeration controllers—to manipulate freezer temperatures in Swedish and French supermarkets, causing widespread food spoilage. The root problem was that critical operational technology (OT) management interfaces were directly reachable from the public internet without adequate access controls or network isolation. This matters because OT attacks have immediate, tangible physical consequences: financial losses from spoiled inventory, food safety risks to consumers, and potential regulatory liability. The incidents also highlight a systemic gap in securing legacy industrial equipment that was never designed with internet-connected threat models in mind.","**Immediate actions:**\n- Remove all refrigeration and OT management interfaces from direct internet exposure by placing them behind VPNs or jump servers.\n- Audit every internet-facing ICS\u002FSCADA device and disable unnecessary remote management ports immediately.\n\n**Long-term improvements:**\n- Implement strict network segmentation between IT corporate networks, OT\u002Foperational networks, and the public internet using firewalls and DMZs.\n- Maintain a complete, up-to-date asset inventory of all OT controllers (e.g., Danfoss, Copeland) and enforce a formal patch and firmware management process for them.\n- Replace or upgrade legacy controllers that lack modern authentication mechanisms and cannot be securely hardened.\n\n**Detection measures:**\n- Deploy OT-aware network monitoring tools to detect anomalous commands or unexpected temperature set-point changes in real time.\n- Configure alerting thresholds so that any temperature deviation beyond safe operational ranges triggers an immediate automated and human response.",[12,13,14,15,16,17,18],"CIS Control 12: Network Infrastructure Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","CIS Control 13: Network Monitoring and Defense","CIS Control 4: Secure Configuration of Enterprise Assets and Software",{"NIS2 Article 21(2)(b)":20,"NIST SP 800-53 SI-2: Flaw Remediation":21,"CIS Control 13: Network Monitoring and Defense":22,"CIS Control 12: Network Infrastructure Management":23,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":24,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires operators of essential services—including food supply chain operators—to implement incident handling and risk management measures that would encompass securing critical OT systems against network attacks.","Applying available firmware patches to the Danfoss and Copeland controllers in a timely manner would have removed known exploitable vulnerabilities used in the French attacks.","Continuous monitoring of OT network traffic would have detected unauthorized commands sent to refrigeration controllers, enabling early intervention before temperatures reached dangerous levels.","Directly applies here: segmenting OT refrigeration controller networks from internet-accessible networks would have prevented attackers from reaching the management interfaces in the first place.","A formal vulnerability management process covering OT assets would have identified the exposed controllers and mandated remediation before attackers could exploit them.","Hardening controller configurations—disabling unused remote management ports and applying secure default settings—would have significantly reduced the attack surface on the refrigeration units.","The controllers lacked proper access controls on their management interfaces; enforcing authentication and restricting remote access would have blocked unauthorized manipulation.","published","2026-11-02T11:21:23.60241+00:00","2026-11-02T11:21:23.588+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fcybersecuritynews.com\u002Fsupermarkets-fridges-hacked\u002F","hackers-hijack-swedish-supermarket-fridges-and-raise-freezer-temperatures-to-55-2fb663","Hackers Hijack Swedish Supermarket Fridges and Raise Freezer Temperatures to 55°C",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[],[49,53,57],{"slug":50,"name":51,"problem":52},"zero-trust-access","Zero trust network access (ZTNA)","Remote access no longer means exposing VPN appliances to the internet.",{"slug":54,"name":55,"problem":56},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":44,"name":58,"problem":59},"Network segmentation and microsegmentation","One compromised machine can no longer reach everything else."]