A commercial freezer is easy to overlook as a cybersecurity risk. That is until a bad actor changes its settings and spoils food. Lots of it.
Recent attacks against supermarket refrigeration systems in France and other countries in Europe demonstrate the consequences of how digital access can disrupt physical operations. Attackers manipulated legitimate controls, including temperature and defrost functions. A Forescout Research – Vedere Labs blog post explored how the incidents exposed a much larger problem: internet-connected refrigeration systems create a cyber-physical attack surface that extends far beyond French supermarkets.
Developments in the United States now give organizations another reason to pay attention.
Reuters reported on October 29 that the Pentagon is treating a series of unexplained freezer malfunctions at U.S. military bases as a suspected cyberattack. At least six military commissaries experienced refrigeration failures in August. In at least one incident, equipment entered defrost mode and heated food overnight.
The investigation remains open.
Reuters could not determine whether investigators had reached a conclusion about what happened or who might be responsible. We should not assume the U.S. incidents and the attacks in France share a perpetrator, vulnerability, or technical cause. But they expose the same fundamental risk: when a digital system controls a physical process, compromising its access path can produce consequences far beyond the network.
The Refrigeration Problem Is Bigger Than Refrigeration
In Cold Chain, Open Control: Exposed Refrigeration Systems Reveal Global Risk, Forescout Research – Vedere Labs examined the refrigeration attack surface. Researchers identified 12,976 internet-exposed service observations across 10 product groups, represented by 6,017 distinct public IP addresses in 99 countries and territories. The research included systems from Copeland/Dixell, Danfoss, CAREL, and other vendors.
These systems do more than report temperature. Refrigeration management platforms let authorized users remotely manage temperature setpoints, defrost schedules, alarms, and other operational variables. Those capabilities support legitimate installation, diagnostics, and maintenance. Contractors and technicians need practical ways to maintain distributed equipment without traveling to every location. The same capabilities, however, make the access path vulnerable. If an attacker gains control of the process, the impact extends beyond compromised data to spoiled inventory, interrupted operations, and disruption to people’s daily lives.
Securing access does not guarantee a safe physical process. Even authorized commands, faulty sensors, and compromised controllers can cause equipment to operate outside of their safe limits. Access controls need to be backed by engineering safeguards and independent monitoring to prevent physical damage.
The central security questions are straightforward:
- Who or what can reach the system?
- What can each identity change?
- Does the connecting device meet the organization’s trust requirements?
- Does policy protect every path to the control function?
- Can the organization detect, investigate, and respond when trust conditions change?
These questions reflect the five universals of Universal Zero Trust Network Access (UZTNA): identity verification, device posture assessment, policy enforcement, application access, and continuous monitoring. These five universals provide a consistent model for extending Zero Trust across systems that connect digital access to physical operations.
Go deeper: Watch the Forescout webinar with Dr. Chase Cunningham: “Your Zero Trust Program Is Half-scoped”.
Secure Remote Access Is Necessary. Open Access Isn’t.
Remote access is essential for maintaining distributed equipment which must be controlled. Organizations need to identify the systems that affect physical operations, eliminate unnecessary internet exposure, remove outdated equipment, and secure all maintenance access.
Legacy OT systems can be decades old and lack modern cybersecurity capabilities. Gateways, network segmentation and microsegmentaiton, and other architecture controls can restrict access, but engineering safeguards must remain in place. These protections must complement, rather than replace, these safeguards that maintain safe operating conditions.
1. Verify every identity
Every employee, contractor, privileged administrator and service account that can reach the environment should be verified. Organizations should eliminate shared and stale contractor credentials, require named identities and multifactor authentication where supported, and grant only the access required for the assigned work.
Access should not persist after the work or business relationship ends.
2. Assess every device
A valid identity does not automatically make the connecting device trustworthy. Organizations need a trust signal from every endpoint that touches the environment, including managed systems, unmanaged contractor devices, and IoT or OT assets that may not support conventional security agents.
The method may vary by device, but an entire class of equipment should not remain outside the trust model because it is difficult to assess.
3. Enforce consistent policy
Access decisions should account for identity, device posture, role, risk and the specific function being requested. An operator who needs to inspect an alarm should not automatically receive permission to change the defrost settings. A technician authorized to work on site should not have direct access to every controller in the environment. Where controllers support function-level authorization, organizations should strictly enforce a secure access policy. Otherwise, they introduce the risk for misuse that goes unchecked without these access restrictions and compensating controls. That same policy should govern connections among applications, workloads and OT systems, limiting lateral movement to only the paths explicitly permitted.
These controls extend least-privilege enforcement across remote, on-premises and hybrid environments.
4. Protect every path to the application
Universal Application Access evaluates access in the context of the identity, device, resource and current conditions. For refrigeration environments, that means applying least-privilege access whether the control function sits behind a vendor portal, cloud console, on-premises management server, legacy application or direct device interface. A technician should reach only the applications and functions required for the job, rather than gaining total network access.
5. Monitor continuously
Authentication should not establish permanent trust. Organizations should log remote-access sessions and correlate them with changes to defrost schedules, temperature setpoints, alarms, users and network configurations. When identity, device posture or behavior changes, security teams need enough context to investigate the activity and restrict or revoke access as necessary.
Continuous monitoring must evolve beyond collecting logs to identifying threats and informing a safe response. In OT environments, automatically isolating a controller can sometimes cause more harm than good if not done with an understanding of the physical process.
A Warning for Every Organization Operating Cyber-Physical Systems
We have to do more than secure the freezers. We must understand which connected systems can affect the physical world and secure every access path that leads to them. We also have to recognize that responsibility can be difficult to assign. Facilities teams, equipment vendors, outside contractors, IT, and security may each hold only part of the picture. Especially across distributed networks with forward deployments. No single team may see the exposed service, network path, contractor identity, and controller lifecycle together.
Multi-stakeholder ownership requires a coordinated approach to cybersecurity and engineering. While the facilities team understands the physical process, the cybersecurity team can identify exposed devices, unauthorized connections, and the lack of digital access controls. Neither perspective is sufficient on its own given the hybrid environment. Forescout’s UZTNA helps organizations better address the digital exposure by integrating identity, device posture, policy enforcement, application access, and continuous monitoring across all endpoints, managed and unmanaged.
The military-base investigation has not established a cause. But alongside the attacks in Europe and the global exposure identified by Vedere Labs, it should prompt all government, military, and civilian security teams to reassess equipment still classified as ordinary facilities infrastructure. If a connected system can control a physical process, its access path is part of the cyber risk.
The lesson extends beyond keeping our food frozen as organizations must understand which digital systems control physical operations. Secure access reduces the window for compromise while the engineering safeguards limit the consequences when prevention fails. Both are necessary as the consequences of poor cybersecurity should never be measured in tons of spoiled food.