Segmentation & Zero Trust

Three Weeks Later, the Fridges Are Burning Again. We Still Haven't Fixed Access.

Three weeks after the first attack, 100+ European stores had fridges hit 50°C through the same open door. Finding vulnerabilities is not the fix. Controlling the access path is.

PG

Pandian Gnanaprakasam

November 3, 2026
5 min read

The first attack was a warning. The second proved that finding a vulnerability is not the same as removing the exposure.

On October 12, I wrote The Fridge Didn’t Fail. The Access Policy Did: stop counting vulnerabilities, start cutting reachability. Three weeks later, it happened again.

Overnight from November 1 to 2, more than 100 stores across Belgium, Sweden, Ireland, the Netherlands, Luxembourg, Estonia and Finland found fridges and freezers running as hot as 50°C. Carrefour, Delhaize, Colruyt, SuperValu, Coop, ICA and an IKEA store were hit, along with butchers and small grocers. Same controllers, same technique, same open door.

The weakness was known. The door stayed open.

Researchers disclosed flaws in Danfoss and Copeland controllers in August. In October, Danfoss blamed outdated firmware, and France’s cybersecurity agency told operators to take the devices off the internet. Yet on November 2, researcher Kevin Beaumont reported that every freezer hit had a management interface reachable from the internet. Censys still counted just over 1,000 exposed Danfoss StoreView interfaces.

The path was short: scan for an exposed interface, get past a weak or default login, and order the store’s refrigeration manager to defrost every case. No phished laptop, no Active Directory, no POS terminal. IT security had nothing to see. The only control that mattered was the one deciding who can reach the controller.

A disclosed vulnerability on a reachable device is not a finding. It is an invitation.

You will never patch your way out

Millions of connected controllers run in stores, hospitals and factories, carrying hundreds of known vulnerabilities reachable from the internet. Patching them all is a noble goal that will never be finished. Many run old, tailor-made operating systems on aging libraries, and some have no patch at all. Fix every known flaw today, and tomorrow brings a zero-day.

The volume is about to explode. As frontier AI models such as Mythos are turned on vulnerability research, flaws in old embedded code will surface faster than any vendor can fix or any team can triage. Detection tells you where to look first. It is not the strategy. A better-ranked list will not keep a single freezer cold.

Advisories don’t scale either. The big chains moved after October, so the second wave found the long tail: in the Netherlands alone, at least 17 businesses, mostly butchers and small grocers. An advisory rarely reaches the contractor who installed a controller years ago, or the shop owner who has never seen its IP address.

Stop racing the vulnerability count. Control the access path.

Maintenance access needs an end time

Contractors do need to reach these controllers. But even through the enterprise firewall, that path does not need to be open all the time. Open it for the maintenance window and close it when the work is done. If an interface is reachable at any hour an attacker chooses, the access is standing, and standing access is exactly the reachability these attackers used.

That takes coordination more than technology. The firewall team must know these ports exist, and business operations, who own the contracts and schedules, must tell them when access is needed. When those teams don’t talk, a port opened for a job years ago stays open indefinitely.

What to do before the third wave

  • Look at yourself from the outside. Scan your own address space for refrigeration, HVAC and building controllers. If Censys can find them, so can an attacker.
  • Default every controller port to closed. Open it only for the scheduled window, from the known contractor source, through a brokered and logged connection, and close it automatically after.
  • Give every rule an owner. Firewall and operations teams review each path to a controller together and remove what nobody can justify.
  • Cover the long tail. Franchisees, small sites and acquired stores need the same controls as headquarters.
  • Watch controller behavior. Alert on endless defrost cycles, extreme setpoints and changes from unusual sources, even inside authorized sessions.

Close the door

In October, the industry could say it was surprised. In November, it cannot.

This is what ORDR does. ORDR accurately identifies every OT device across every site and maps its external access: which ports are open, at which site, from where. ORDR then programs your firewalls to close those ports automatically, with no manual labor, and opens them only for approved maintenance windows. Every change runs through proper governance: proposed, simulated, approved and logged.


Editorial note: Incident details reflect public reporting as of November 3, 2026. Store counts, affected countries, the access method and attribution are still under investigation and may change.

Sources

ShareLinkedInX