Imagine walking into hundreds of grocery stores on a Monday morning to discover that freezer cases haven’t just shut off—they’ve actively heated up to 50°C (122°F). Perishable inventory is destroyed, store aisles are filled with smoke, and fire departments are responding to retail sites across multiple countries.
Over the weekend, threat actors executed a coordinated cyberattack targeting refrigeration systems across major French supermarket chains—with ripple effects reported in Spain, Portugal, Germany, Belgium, and Poland.
The mechanism wasn’t an exotic, nation-state zero-day. Attackers simply scanned the public internet for legacy Danfoss refrigeration controllers running outdated firmware, gained administrative access, and triggered the devices’ built-in automatic defrost cycles. By abusing a standard maintenance feature, threat actors turned critical chilling infrastructure into distributed heating elements. Public discovery engines like Shodan revealed more than 4,500 Danfoss systems directly exposed to the internet, with thousands concentrated in European retailers.
This incident is a textbook example of a growing crisis facing modern distributed enterprises: the chasm between IT security policies and operational technology (OT/IoT) reality.
Kinetic Consequences: The New Reality of Cyber-Physical Risk
For years, cybersecurity discussions centered around data loss, intellectual property theft, and ransomware encryption of IT databases. The European supermarket incident demonstrates that cyber-physical attacks have moved from theoretical conference talks into real-world business disruption. The overall shift of ransomware from data theft to holding operations for ransom is accelerating.
When adversaries compromise OT and IoT systems—whether they are HVAC chillers, access control panels, security cameras, or refrigeration units—the consequences are physical and immediate. Millions of euros worth of spoiled, unsalable inventory discarded overnight. Heating elements left running unchecked caused electrical fires and smoke conditions. Retail locations being forced to close during peak operating hours. Reputational damage and insurance liabilities cascading across retail distribution networks.
In operational environments, availability and physical integrity are non-negotiable. Yet, the devices governing these environments are frequently the most neglected endpoints in the entire enterprise.
The Operational Blindspot: Who Actually Owns the Freezer?
Why were thousands of legacy industrial controllers reachable over the public internet with outdated software in the first place? The answer lies in an organizational fault line: the OT/IoT ownership gap.
In most distributed enterprises—retail chains, hospitals, universities, logistics hubs—refrigeration, building automation, and physical security systems are procured, installed, and serviced by third-party facilities vendors who often are not focused on cybersecurity. To make routine servicing and remote telemetry easier, technicians frequently attach these controllers directly to cellular modems, bypass corporate firewalls, or expose administrative web interfaces directly to public IP addresses without VPNs, multi-factor authentication, or network segmentation. A small network change is all that is needed to make OT/IoT devices visible to the internet.
Corporate IT doesn’t manage them. Security teams can’t patch them with traditional IT endpoint agents. And facilities teams operate on the premise: “If it’s keeping the milk cold, don’t touch the firmware.” The result? Thousands of unmanaged, internet-facing devices quietly accumulating technical debt and unpatched vulnerabilities until an attacker finds them.
Why Traditional Security Tools Fall Flat on OT/IoT
When an event like this makes headlines, the first reaction from IT leadership is often: “Why didn’t our endpoint detection or vulnerability scanner catch this?”
Traditional enterprise security tools were built for Windows, Linux, and macOS environments, using agents mounted on these operating systems to work. Applying standard IT playbooks to OT/IoT devices fails for three fundamental reasons: agents can’t be placed on non-standard operating systems, active scanning can crash fragile systems, and visibility does not equal being able to quickly remediate it. Manually dispatching field technicians to patch firmware and rotate credentials across 500 grocery stores or warehouse sites is cost-prohibitive and operationally unfeasible.
Knowing you have 1,500 vulnerable controllers is useless if you don’t have an automated way to remediate them.
Building an Actionable Cyber Hygiene Strategy for OT/IoT
The attack on European supermarkets should serve as a wake-up call to boards, CISOs, and VP-level operations leaders everywhere. The threat actors didn’t crack modern encryption; they took advantage of forgotten, internet-exposed controllers that lacked basic cyber hygiene. When operational technology is neglected, digital threats quickly become physical disasters.
To prevent building automation and other OT/IoT assets from becoming weaponized entry points, organizations must adopt an automated, purpose-built hygiene framework. Central to that is making the shift from Passive Visibility to Automated Remediation
Vulnerability management is only as good as the time-to-remediation. Organizations need platforms that don’t just alert security analysts, but actively automate firmware updates, password & credential rotation, and certificate lifecycle management.
You can’t secure what you can’t manage—and you can’t manually manage thousands of distributed IoT and OT assets. True resilience requires moving beyond passive discovery to automated, continuous device hygiene before an attacker turns your cold storage into an inferno.
Learn how the Viakoo Action Platform automates OT/IoT device hygiene—remediating firmware, enforcing credentials, and ensuring zero-trust compliance across your entire physical infrastructure footprint. Request a Demo.
