Louis Eichenbaum, Federal CTO at ColorTokens, comments, “This attack is another stark reminder that cyberattacks against operational technology can have immediate, real-world physical consequences. We are no longer talking simply about stolen data or disrupted computer systems. We are talking about attackers manipulating physical equipment, destroying inventory, potentially creating fire hazards, and disrupting essential services.

“What makes this incident particularly concerning is that the attackers reportedly exploited legitimate functionality within refrigeration control systems. They didn’t necessarily need to destroy the equipment or deploy sophisticated malware. They simply needed unauthorized access to the controllers and the ability to manipulate how those systems operated.

“This highlights a fundamental weakness in how many organizations approach OT security. Operational systems were traditionally designed for reliability and availability, not to withstand sophisticated cyberattacks. Many still rely on legacy software, outdated authentication mechanisms, and network architectures that provide far more connectivity than is operationally necessary.

“Organizations need to adopt an ‘assume breach, assume vulnerable’ approach to OT security. That starts with knowing exactly which operational assets exist, understanding their communications and dependencies, and eliminating unnecessary internet exposure. But visibility alone is not enough. Organizations must also implement granular microsegmentation and least-privilege access controls that restrict which systems and users can communicate with critical controllers.

“Even if an attacker compromises a workstation, remote access service, or another connected device, that compromise should not automatically provide a pathway to refrigeration controllers or other critical operational assets.

“The larger lesson extends well beyond supermarkets. The same fundamental risks exist in manufacturing facilities, water treatment plants, energy infrastructure, transportation systems, and other environments where digital controls directly influence physical processes.

“Cybersecurity in these environments must focus not only on preventing initial compromise, but also on limiting what an attacker can reach and manipulate after gaining access. Ultimately, our goal must be to ensure that a cybersecurity incident does not become a physical safety incident or a mission-disrupting event.”

On Monday, Predicta Lab CEO Baptiste Robert stated in a social media post that he discovered 2752 Danfoss systems exposed online. 1590 of them were in France. 

John Gallagher, Vice President at Viakoo, says, “This was not a sophisticated attack; malicious hackers simply scanned the public internet for Danfoss controllers running end-of-life firmware and weak passwords. Once control was established, they then could use a legitimate function of the system (the defrost cycle) to turn the system from a refrigerator to a heating element.

“This continues an alarming trend, which is using cyberattacks not for data theft but to create physical kinetic damage by exploiting OT/IoT devices. The shift of ransomware to operations systems increased by 57% last year, and that trend is aggressively continuing.

“Speed of remediation is the key area for organizations to focus on. Malicious hackers using Shodan found these devices in minutes showing that asset discovery and visibility is not the issue, it’s automating cyber hygiene. Organizations who have no automated mechanism to enforce firmware updates, rotate credentials, and fix configuration drift on OT/IoT assets across hundreds of remote sites are going to remain highly vulnerable to such attacks.

“Legacy and EOL firmware on OT/IoT systems cannot be ignored. The older Danfoss controllers running unsupported firmware were sitting ducks in this situation. Enterprises must establish automated policies that either enforce continuous firmware patching or mandate compensatory network isolation the moment a device reaches end-of-life.

“Cyber-physical risk is now a boardroom issue. This attack directly hit bottom-line revenue — spoiled perishable inventory, store closures, and real fire risk. Securing building automation and other OT/IoT devices is now fundamental to business continuity.”