The Fridge Hack That Exposed a Dangerous Gap in Business Security
Attackers didn’t phish a French supermarket chain last month. They targeted its refrigeration systems remotely and put its fridges into defrost. Hundreds of stores lost stock, several had fires, and cabinets sat at 50°C for about six hours before anyone intervened.
Then it happened again, across Sweden, Belgium, Luxembourg, Ireland, the Netherlands and Estonia, with UK meat processors caught in the same wave. Same equipment, same move. ICA, Sweden’s largest grocer, said every store hit used an external refrigeration provider wired outside the corporate network; the centrally managed estate wasn’t touched. The kit nobody in IT owned was the kit that went to 50°C.
The Systems Outside IT Can Create the Biggest Security Blind Spots
No malware on a laptop. Controllers on the internet, on old firmware, some still on default passwords, managed by a contractor – watched for uptime, not for intrusion. The NCSC has been warning UK organisations with the same exposure.
Most businesses can list their laptops. Few can say who can log into their refrigeration, HVAC, cameras or door controllers, from where, and what changed overnight. Those devices don’t take a security agent, so a Security Operations Centre (SOC) focused solely onendpoints never sees them.
Securing Operational Technology Starts with the Basics
The immediate fixes are dull: find the controllers reachable from the internet, change the default passwords, get them off the internet, patch them, and secure contractor access via MFA-protected gateways.
Security Monitoring Needs to Go Beyond the Endpoint
The second fix is the one most estates skip: knowing who logs into operational systems, what configuration changes, and whether the physical process starts behaving oddly. That means bringing remote-access logs, network telemetry and operational data into the SOC, even where the controllers themselves cannot take a security agent.
Would Your SOC Know Something Had Changed?
A refrigeration controller entering an unscheduled six-hour defrost at 2 a.m. should alert the SOC as well as the refrigeration engineer – and the SOC should be asking who changed it before anyone changes it back.
The underlying question isn’t whether your SOC can see every device. It’s whether your SOC can detect someone manipulating the systems your business depends on.
OT Security Is an Ownership, Access and Detection Problem
OT security is not just an asset visibility problem. It’s an ownership, access and detection problem.
For enterprise organisations, that could mean thousands of connected systems distributed across offices, warehouses, factories or retail locations. For an SMB, it might simply be the HVAC, access control, CCTV or environmental systems managed by an external provider. The scale changes, but the security question doesn’t: who has access, who is monitoring that access, and who will notice when something changes?
Could You Spot a Threat Before It Disrupts Your Business?
See what our security analysts are detecting in the real world. Read our latest SOC Threat Detection Reportfor insight into the threats, techniques and behaviours we’re seeing.
Or, if you’re unsure where gaps might exist in your own environment, talk to our security team about your current visibility and risk.