Legacy OT Refrigeration Controllers Exploited Across French Supermarket Chain
This attack exploited legacy operational technology (OT) controllers managing refrigeration systems — devices that are often overlooked in traditional IT security programs due to their specialized nature and long operational lifespans. The root cause lies in unpatched, aging OT hardware that was likely internet-accessible with little to no network isolation from the broader corporate environment. What makes this incident particularly alarming is the direct physical consequence: compromised food safety, spoiled inventory, and significant business disruption — demonstrating that cyber threats to OT are no longer theoretical. Organizations managing critical infrastructure must recognize that any networked device, regardless of its function, represents a potential attack vector. This incident underscores the urgent need to extend cybersecurity governance to OT and industrial control systems (ICS) with the same rigor applied to IT assets.
Tactical Insight
Immediate actions
- Audit and inventory all OT/ICS devices, identifying legacy controllers that are internet-facing or unpatched, and isolate them from the public internet immediately.
- Apply all available vendor patches or firmware updates to refrigeration and building management controllers, or implement compensating controls where patching is not feasible.
- Force credential rotation on all OT management interfaces and disable default or shared credentials.
Long-term improvements
- Implement strict network segmentation by placing all OT systems in isolated VLANs with firewall-enforced policies that deny unrestricted IT-to-OT lateral movement.
- Establish a formal OT asset lifecycle policy that triggers security reviews and replacement planning when devices reach end-of-support status.
- Integrate OT devices into a unified vulnerability management program with dedicated scanning tools suited for industrial protocols (e.g., Claroty, Dragos, Nozomi).
Detection measures
- Deploy OT-aware intrusion detection systems (IDS) capable of baselining normal operational traffic and alerting on anomalous commands or connections.
- Establish 24/7 monitoring and alerting for OT control plane changes, unexpected reboots, or configuration modifications on critical building management systems.
- Define and test an OT-specific incident response playbook that includes escalation paths to physical operations teams when cyber events have real-world consequences.