Attackers aren't always after your data. Recently, they've targeted your cold chain. Hackers raised temperatures on three cold stores holding blood products at France's national blood service. Copycat attacks have since spread across refrigeration units following the initial Danfoss controller attacks. This roundup highlights key findings and translates them into actionable steps for your team.
Shifting Objectives
The primary shift in these incidents is the focus on physical process integrity, not data confidentiality. Success is now measured by spoiled products and service disruptions, not stolen records.
The pattern has three layers. The Danfoss controller attacks spotlighted refrigeration units, leading to copycat incidents. Several European retailers have reported cyber incidents affecting their stores, according to Reuters (November 3): Ahold Delhaize, Carrefour, Colruyt Group, Coop, De Laet & Van Haver, Edeka, ICA, and Musgrave. A New York Times report suggested a link between refrigeration malfunctions at U.S. military facilities last summer and cyber activity; officials are investigating.
Key Findings
1. Published Weaknesses as Templates John Gallagher, Vice President at Viakoo, noted that the Danfoss controller attacks highlighted refrigeration units, making follow-on attacks predictable. Once one device class is exposed, others of the same type will likely be tested. Action: Treat any public report of exploitation in a device family you operate as a trigger for an out-of-cycle review in your Cybersecurity Risk Register.
2. Patching Isn't Enough for Legacy OT Robert Costello, Chief Digital and Information Officer at Merlin Group, pointed out that software updates can't always resolve these issues, and hardware replacement may be necessary. Zero-trust principles can help but may require rebuilding environments. Louis Eichenbaum, Federal CTO at ColorTokens, agreed: patching alone is insufficient. Action: Stop using patch percentage as your primary OT Key Control Indicator. Add exposure-based indicators: internet-facing consoles, assets with no remediation path, and segments with unrestricted lateral access.
3. Third-Party Remote Access Blind Spots Thomas Plank, CEO of Tributech, noted that the blood service attack reportedly came through a refrigeration service provider, not the blood service itself. Third parties often have remote access to physical equipment, trusting whatever arrives on that channel. Action: Your vendor risk assessment should ask what the provider can command, from where, and under what authentication.
4. Rejecting Unsafe Commands Plank highlighted that a freezer holding plasma accepted a command to heat itself to 110°C. No legitimate operator would send that command, indicating a Control Design failure. Action: Define safe operating envelopes at the controller or gateway, and reject out-of-range setpoints regardless of the sender.
5. Resilience Over Prevention Eichenbaum argued that cybersecurity must ensure essential services continue during an attack, measuring success by containment and operational continuity. He raised the concern that adversaries might be testing defenses ahead of something larger. Action: Your Cyber Risk Appetite statement should address operational continuity for physical processes, not just data loss.
Implications for Your Team
Most enterprise GRC programs focus on data. Controls map to confidentiality, access reviews, and breach notification. OT doesn't fit neatly into this structure: facilities or operations often own it, vendors have remote access, and assets may predate your security program.
Three gaps arise. Ownership: if no one in your Risk Portfolio is accountable for refrigeration or building controllers, no one is testing them. Inventory: you can't segment or monitor what you haven't identified. Third-party scope: service providers with remote access to physical equipment may fall outside your standard vendor tiering.
For regulated entities, consider disclosure as well. An outage at a cold chain, hospital, or retailer can be material. Your Incident Response Structure should state who decides, and on what criteria, whether a disruption to physical operations is reportable, including for Form 10-K and Form 10-Q risk factor language where applicable.
Action Items by Priority
Immediate (days)
- Put any internet-facing consoles behind firewalls and disable unnecessary remote access (Gallagher).
- Update firmware where available and rotate passwords, including vendor and shared credentials (Gallagher).
- Decommission end-of-life systems that can't be protected (Gallagher).
- Identify every third party with remote access to physical equipment and confirm how that access is authenticated.
Near Term (weeks to a quarter)
- Build or refresh an OT asset inventory to identify exposed assets and eliminate unnecessary internet access (Eichenbaum).
- Enforce strong authentication on all remote paths and move remaining systems onto segmented networks where access can be controlled (Gallagher, Eichenbaum).
- Add OT and third-party remote access scenarios to your Cybersecurity Risk Register, with named owners and Severity Levels tied to operational impact.
- Update vendor due diligence to cover command authority, session logging, and access revocation.
Structural (budget cycle)
- Fund microsegmentation, continuous monitoring, and zero-trust access controls for critical OT segments (Eichenbaum). Costello's caution applies: this can require substantial rebuilds, so phase the work by criticality.
- Plan hardware replacement for assets with no remediation path, and document interim compensating controls as Approved Exceptions with an expiry date.
- Test recovery procedures for physical processes. Run a tabletop where a cold storage setpoint is altered and your team must detect, contain, and preserve product.
- Report OT resilience metrics on the GRC Dashboard so the board sees continuity risk alongside data risk.
