Refrigeration Controller Vulnerabilities Enable Remote Supermarket Attacks
Attackers exploited unpatched vulnerabilities in internet-exposed Danfoss refrigeration controllers to remotely manipulate temperatures across hundreds of European supermarkets, causing widespread food spoilage. This incident underscores a critical and often overlooked risk: Operational Technology (OT) devices such as HVAC and refrigeration controllers are frequently deployed with default configurations, minimal authentication, and delayed patching cycles — making them attractive targets. Unlike IT systems, compromised OT devices can cause direct physical harm, financial loss, and public safety consequences. The attack demonstrates that OT environments must be treated with the same security rigor as enterprise IT infrastructure.
Tactical Insight
Immediate actions
- Immediately audit all internet-facing OT/ICS devices (e.g., refrigeration controllers) and remove direct public internet exposure.
- Apply all available vendor patches and firmware updates to Danfoss controllers and equivalent OT equipment.
- Change all default credentials on OT devices and enforce strong, unique passwords for remote access.
Long-term improvements
- Implement strict network segmentation by placing OT systems on isolated VLANs with firewall-enforced boundaries separating them from corporate IT networks.
- Establish a dedicated OT asset inventory and assign ownership for patching and vulnerability tracking on all industrial control devices.
- Require multi-factor authentication (MFA) and VPN-gated access for any remote management of OT/ICS systems.
Detection measures
- Deploy OT-aware monitoring solutions (e.g., Claroty, Dragos, or Nozomi) to detect anomalous commands or temperature parameter changes in real time.
- Define and alert on operational baselines so any deviation in refrigeration set-points triggers an immediate security and operations notification.
- Conduct regular penetration testing and vulnerability assessments specifically targeting OT/ICS environments.