OT/ICS Cyberattack Spoils Food Stocks by Hijacking Supermarket Refrigeration Systems
Attackers exploited vulnerabilities in legacy industrial control software from Danfoss to manipulate refrigeration defrost cycles, driving temperatures to 50°C and causing millions of euros in food spoilage losses. The root problem lies in operational technology (OT) systems — refrigeration controllers, HVAC, and similar industrial devices — being reachable over networks without adequate isolation from corporate IT environments or the internet. Older control software in critical infrastructure is frequently unpatched and unmonitored, creating a wide attack surface that is attractive to threat actors seeking physical, financial, or disruptive impact. This incident underscores that cyberattacks are no longer confined to data theft; they can cause direct physical and economic harm to essential supply chains.
Tactical Insight
Immediate actions
- Audit and isolate all OT/ICS devices (refrigeration controllers, HVAC, PLCs) from corporate IT networks and the public internet immediately.
- Inventory all industrial control software versions and apply available patches or vendor mitigations, prioritising legacy systems like the affected Danfoss software.
- Change all default credentials on OT devices and enforce strong authentication for remote access.
Long-term improvements
- Implement strict network segmentation using DMZs and industrial firewalls to separate OT environments from IT networks and external connectivity.
- Establish a dedicated OT/ICS vulnerability management programme that tracks EOL software and firmware across all vendor-supplied control systems.
- Develop and regularly test an OT-specific incident response plan that includes procedures for physical asset protection (e.g., manual temperature overrides, backup cooling protocols).
Detection measures
- Deploy OT-aware monitoring tools (e.g., Claroty, Dragos, Nozomi) to detect anomalous commands or parameter changes in industrial control systems.
- Set automated alerting thresholds on critical physical parameters such as refrigeration temperature deviations beyond acceptable ranges.
- Require vendors like Danfoss to provide a Software Bill of Materials (SBOM) and timely security advisories for all deployed control software.