SHIELD

Organization and team

Nobody decided your fridges would obey remote commands

The attack on Danfoss refrigeration systems did not reveal a security flaw, but a governance decision nobody had ever made.

Published 4 min read Critical

Last reviewed:

Commercial refrigerator in a supermarket

We will secure the controllers. Nobody asks who decided they could be operated from outside.

In the night of 11 to 12 October 2026, hundreds of French supermarkets found frozen aisles to discard by morning. DanfossDanfoss central refrigeration controller, web-accessible, targeted in the October 2026 attack. refrigeration controllers had been operated remotely to trigger defrost cycles, with temperatures pushed to around fifty degrees. Intermarché, Netto, Coopérative U, Carrefour, Leclerc, Monoprix. The Minister of Economy cited 700 stores out of 10,000, the Paris prosecutor’s office opened an investigation, and the attack spread to Belgium, Spain and Germany.

Since then, everyone has discovered OTIT systems that control physical equipment: PLCs, sensors, industrial controllers. and wants to secure it. Segment the networks, audit suppliers, patch controllers, isolate management interfaces. None of that is wrong. But it looks at the lock without asking who installed the door.

Nobody ever decided that a store’s refrigeration would be operable from the outside. The capability arrived in layers. A maintenance contract that includes remote monitoring, more convenient than dispatching a technician. A manufacturer adding remote control to its product line. A refrigeration contractor connecting it because that is what the maker sells. Each step justifies itself. At the end, one morning, the executive learns that part of their production infrastructure obeys someone else, and they do not remember signing for it.

The Danfoss AK-SM 800A is a central manager: it coordinates a store’s controllers and exposes a web interface for viewing circuits and setting thresholds. In August 2026, at DEF CON, Claroty’s Team82 demonstrated three vulnerabilities in that interface and a striking proof of concept: a compromised controller can cut the cold while displaying normal temperatures. The researchers also noted thousands of management interfaces publicly accessible. The vulnerability was known. So was the exposure.

The security reflex runs into a blind spot. Security fixes what was poorly protected. It does not decide what should exist. You can encrypt, segment and monitor a device nobody wanted in the first place, and you will have protected it better. The question sits upstream, and it does not belong to the engineer: what should be remotely operable in your organisation, by whom, and what are you prepared to lose if it fails. Once that answer is written down, security becomes an ordinary technical matter. Before that, it patches gaps.

One question the attack raises and nobody settles. If nobody decided, who is liable. The retailer that suffers. The refrigeration contractor whose maintenance contract included remote access. The equipment manufacturer whose interface sat exposed with a known flaw. And does business interruption insurance cover a loss whose cause lies with a third party the insured never chose. These answers are not technical either.

The flaw was not in the software, but in a decision nobody made.
Shield — shield.travel

Angle de lecture

At home, the same drift. The thermostat, the alarm, the camera, the gate arrived remotely operable by default. You did not choose to have your heating obey a remote server, that was the box ticked at installation. The question applies to your home: what actually needs to be controlled from outside, and what would work perfectly well without it.

Your inventory lists servers and workstations. It rarely lists what, in your OT, obeys from outside: BMS, refrigeration, controllers, UPS units, and their maintenance interfaces. Start there. Who has remote access, through which channel, stipulated by which contract. Many of those doors were opened by a maintenance contractor, not by you, and appear on no diagram. A publicly exposed management interface leaves the controls of your industrial infrastructure accessible from anywhere. Treated as simple technical debt to patch later, it remains an open door in the meantime.

This decision is yours, not your CIO’s or your refrigeration contractor’s. They secure, segment, monitor. They do not decide on your behalf what your organisation hands to the outside, or what it accepts to lose. Three things to settle and impose: what must remain remotely operable and what gets switched off; who holds that access, and what your maintenance contracts actually authorise; how long you can hold if that function fails. Ask your insurer before a loss, not after: is a business interruption caused by a third party you never chose covered. The remedy is a decision, and it is made upstream.

Action items

  • N1 List everything in your production infrastructure that is remotely operable: refrigeration, BMS, controllers, UPS units, cameras, locks.
  • N1 Find out who holds that access — equipment manufacturer, refrigeration contractor or maintenance provider — and what the contract actually authorises.
  • N1 Decide, for each capability, whether remote operation is necessary or whether it can be switched off.
  • N2 Write down what you accept to lose if that function fails, and how long you can hold without it.
  • N2 Ask your insurer whether a loss whose cause lies with a third party you did not choose is covered.
  • N3 Once those decisions are made, hand the rest to the technical side: segmentation, encryption, monitoring.

Sources

Related articles