[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWikxHsTljc22HB7xhWSaACm57XZusUPKGLsLu67pTuE":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"bf9091a2-f562-4f24-85d9-7e1cb645f9f8","unpatched-fridge-firmware-costs-eu-grocers-millions","5a0c0825-7e1e-464e-9aef-e877960f6d2f","Unpatched Fridge Firmware Costs EU Grocers Millions","European grocery chains suffered major financial losses after attackers exploited unpatched firmware vulnerabilities in internet-connected refrigeration systems — operational technology (OT) assets that are frequently overlooked in traditional IT security programs. The involvement of third-party managed service providers compounded the risk, as patch accountability fell into a gap between the retailers and their vendors. This incident illustrates that every networked device, regardless of its physical function, represents an attack surface that must be actively managed. Ignoring OT\u002FIoT firmware patching is no longer acceptable in an era where critical infrastructure and retail operations are deeply interconnected.","**Immediate actions:**\n- Conduct an emergency audit of all OT\u002FIoT firmware versions across refrigeration and building management systems and apply available patches immediately.\n- Isolate unpatched or end-of-life refrigeration control systems from corporate and internet-facing networks until remediation is complete.\n\n**Long-term improvements:**\n- Establish a comprehensive asset inventory that explicitly includes OT and IoT devices, with assigned patch ownership for both internal teams and third-party vendors.\n- Embed contractual patch management SLAs and security audit rights into all managed service provider agreements.\n- Implement a formal OT\u002FIoT vulnerability management program with defined patching windows and risk-acceptance escalation procedures.\n\n**Detection measures:**\n- Deploy network monitoring tools capable of detecting anomalous traffic from OT\u002FIoT segments, including unusual outbound connections from refrigeration controllers.\n- Require third-party MSPs to provide regular patch compliance reports and integrate their systems into your centralized logging and alerting platform.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 1 – Inventory and Control of Enterprise Assets","CIS Control 2 – Inventory and Control of Software Assets","CIS Control 7 – Continuous Vulnerability Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-82 – Guide to ICS\u002FOT Security","NIST SI-2 – Flaw Remediation","NIST SA-9 – External Information System Services (Supply Chain)","NIST IR-4 – Incident Handling","IEC 62443 – Industrial Automation and Control Systems Security","GDPR Article 32 – Security of Processing (where personal data resides on affected networks)","ITIL Change Management – Emergency Change procedures for critical patches",{},"published","2026-10-15T08:20:19.563484+00:00","2026-10-15T08:20:19.544+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fwww.darkreading.com\u002Fics-ot-security\u002Feu-grocers-unpatched-fridge-firmware","eu-grocers-pay-a-steep-price-for-unpatched-fridge-firmware-a87219","EU Grocers Pay a Steep Price for Unpatched Fridge Firmware",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",{"id":39,"name":40,"slug":41,"description":42,"color":43},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",{"id":45,"name":46,"slug":47,"description":48,"color":49},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[],[52,55,59],{"slug":35,"name":53,"problem":54},"Automated patch management","Known holes get closed in days, not months.",{"slug":56,"name":57,"problem":58},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":60,"name":61,"problem":62},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection."]