Segmentation & Zero Trust

The fridges burned twice. The door was the same both times.

Two waves of attacks on supermarket refrigeration controllers hit the same open door. Here is how ORDR finds exposed controllers and closes the path to them.

RB

Reese Borel

Technical Account Manager

November 3, 2026
3 min read

What happened

On November 1–2, 2026, more than 100 stores in seven European countries found fridges and freezers running as hot as 50°C, three weeks after a first wave in France. Grocery chains, an IKEA store, butchers and independent grocers were hit.

Flaws in Danfoss and Copeland controllers were disclosed in August, and France’s cybersecurity agency told operators in October to take the devices off the internet. Yet every affected freezer reportedly had an internet-reachable management interface, and Censys still found about 1,000 exposed Danfoss StoreView interfaces.

No phishing or corporate foothold was needed: find an exposed interface, get past a weak or default login, and order every case to defrost. The only control that mattered was who could reach the controller.

Why patching alone won’t close this

Many controllers can’t be patched quickly or at all, and advisories rarely reach the installer or franchisee responsible for them; the second wave found exactly that long tail. The durable fix is controlling which systems can reach these controllers, from where, and when.

Where ORDR helps

  • Know every controller, at every site. Agentless discovery and classification of IoT, OT and building-management devices from existing network data (SPAN, NetFlow, DHCP, DNS, SNMP), each tied to its site, switch port and VLAN. Small sites can use NetFlow or Catalyst 9000-hosted sensors.
  • See who reaches them, and who they reach. Flow Genome baselines every device’s communications, including traffic to and from the internet. A controller talking to external addresses stands out, along with its protocols and destinations.
  • Prioritize the exposure that matters. Correlates devices with NVD/CVE and ICS-CERT data and flags outdated software and risky protocols, so a vulnerable, internet-facing controller rises to the top.
  • Close the path without redesigning the network. Generates least-privilege policy from observed behavior, validates it before enforcement, and enforces through existing firewalls (Palo Alto Networks, Fortinet, Check Point), NAC such as Cisco ISE, switches and wireless, including rules blocking controllers from the internet.
  • Catch what gets through. Raises a security incident when a device drifts from its baseline or contacts malicious or high-risk destinations, and passes it to your SIEM, XDR or ITSM.

Before the next wave

  1. Check your external exposure. Scan your public address space for controllers. ORDR complements this from the inside, showing which controllers actually exchange internet traffic, by site.
  2. Close controller access by default. ORDR policy, enforced via firewall or NAC, blocks internet access by default; exceptions only from known contractor sources.
  3. Assign an owner to every access rule. Device context (type, site, business function) gives firewall and operations teams a shared view to retire unjustified paths.
  4. Extend controls to every site. Same inventory and policy for franchisees, small stores and acquired sites as for headquarters.
  5. Monitor controller behavior. Alerts on new external peers, unusual sources and new protocols. Setpoints and defrost schedules remain the refrigeration system’s to monitor.

Find out which of your controllers can be reached from the internet.

Talk to your ORDR team or request a demo at ordr.net/request-demo.

Editorial note: Public reporting as of November 3, 2026; details may change.

Sources

ShareLinkedInX