TL;DR: Remotely attacked refrigeration controllers in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden were raised to 50 degrees Celsius, spoiling food in dozens of stores, while just over 1,000 Danfoss StoreView instances remain exposed globally, according to Censys research. Internet-exposed industrial controllers turn routine building systems into operational attack surfaces that need asset visibility, patching and segmentation.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Censys's research: Internet-exposed refrigeration controllers were remotely manipulated to spoil food in dozens of stores, showing how ordinary operational technology can become a public attack surface.
Why it matters: This matters because retailers and food operators need to treat internet-reachable building controls as production assets with security, patching and exposure management requirements, not as isolated facilities equipment.
By the numbers:
- Censys observes just over 1,000 Danfoss StoreView instances exposed globally.
- France had 220 total exposures of Danfoss StoreView at the time of analysis.
- 41% of StoreView instances in France appear to be running a patched firmware version.
- 68% of StoreView instances in Belgium appear to be running a patched version.
Context
Refrigeration controllers are operational systems that regulate temperature in stores, warehouses and other facilities. When those devices are reachable from the public internet, they stop being background equipment and become remotely reachable control points that can affect product safety and business continuity.
The pattern here is not novel in security terms, even if the target is unusual: exposed internet-facing devices can be discovered, interacted with and altered without anyone stepping inside the building. Where the equipment sits in retail and food supply operations, the impact is immediately visible in spoiled stock and disrupted trade.
Key questions
Q: How do teams secure internet-exposed industrial controllers?
A: Teams secure internet-exposed industrial controllers by removing direct exposure where possible, placing them behind VPNs, jump hosts or industrial DMZs, and restricting management to allowlisted source addresses. They should disable default credentials, require strong authentication for remote access, segment OT and IT networks, log administrative sessions, and keep firmware, firmware settings and engineering workstations under strict change control.
Q: Why do exposed OT devices create such high operational risk?
A: Exposed OT devices create high risk because control systems are designed to be stable, trusted, and continuously reachable. If an attacker can change credentials, routing, or device settings, the organisation can lose both control and situational awareness. That combination is especially dangerous in water systems, where service disruption can affect safety as well as uptime.
Q: What is the difference between an exposed asset inventory and real exposure management?
A: An exposed asset inventory lists what exists on the perimeter. Real exposure management explains which assets are actually dangerous, why they are dangerous, and how an attacker could use them. It combines ownership, business function, exploitability, data exposure, and network context so teams can rank risk in a way static inventories cannot.
Q: What should teams do first when an operational controller is internet-exposed?
A: The first step is to treat the controller as an exposed asset and immediately limit reachable services, users and source networks. Teams should isolate it from the public internet, disable unsafe remote administration paths, rotate any credentials that may already be exposed, and verify whether the controller has been tampered with before restoring normal access.
Technical breakdown
Why exposed refrigeration controllers are vulnerable to remote tampering
Commercial refrigeration controllers often expose management interfaces for monitoring, configuration and firmware maintenance. If those interfaces are reachable from the internet, an attacker does not need to compromise a user endpoint first. They can identify the device, interact with its control surface and change operating settings directly. The risk rises when device authentication is weak, firmware is outdated or administrative interfaces are left open beyond the intended service boundary. In retail and food environments, that creates a bridge from infrastructure exposure to business interruption. See the IoT security guide.
Practical implication: Restrict external reachability for refrigeration and building-control interfaces before focusing on more complex response measures.
Why firmware patching matters more than device count alone
Exposure data only becomes actionable when it is paired with firmware state. A device that is online but patched may still be visible, but it is materially less likely to be the same immediate risk as an exposed unit running a vulnerable build. In this case, the reported split between pre-4.2 and 4.3.1+ versions shows that visibility and remediation are separate problems. Security teams need both an inventory of exposed assets and a way to distinguish current, patched systems from legacy ones still carrying known weaknesses.
Practical implication: Track exposed assets by firmware version so remediation can prioritise vulnerable builds rather than every reachable device equally.
How operational technology becomes a public attack surface
Operational technology is not only a plant-floor concern. Once controllers, sensors or gateways are connected to remote administration portals, they inherit the exposure patterns of ordinary internet services. That means scanning, opportunistic abuse and targeted manipulation can all occur from outside the facility. The security boundary is no longer the physical store or warehouse door, but the remote interface itself. For retailers, that shifts risk management toward external exposure control, segmentation and lifecycle patching of connected equipment.
Practical implication: Treat remote management paths for operational controllers as internet-facing services and govern them with the same discipline as other exposed assets.
Threat narrative
Attacker objective: The objective was to disrupt food operations by remotely degrading refrigeration performance and causing product loss.
- Entry occurred through internet-reachable refrigeration controllers that could be located and addressed remotely.
- The attacker changed temperature settings on exposed units rather than compromising store staff or internal systems first.
- The escalation was operational, not privilege-based: remote control of the controller translated directly into altered refrigeration behaviour.
- Impact appeared as spoiled or melted food in dozens of stores across multiple countries.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Internet-exposed building controls are now a retail resilience problem, not a niche OT issue. These controllers sit outside the usual IAM conversation, but their exposure profile still determines whether an outsider can influence core operations. When the attack surface is a management interface, operational continuity depends on asset visibility, segmentation and disciplined patching. Practitioners should treat facility controllers as production-critical digital assets, not passive equipment.
The control failure here is exposure, not just vulnerability. A device can be fully known and still unsafe if its administrative path remains reachable from the internet. That is the governance gap: inventory without enforced reachability limits creates a false sense of control. The right question is not whether a controller exists, but whether it can be touched from outside the intended trust boundary.
Patched and unpatched devices must be governed as different risk classes. Censys's exposure data shows that visible device counts alone do not tell the full story. Remediation prioritisation has to separate current firmware from legacy builds because the attackability of each class is materially different. Security teams should build exposure dashboards that combine reachability, version state and business criticality.
Retail OT now needs the same external discovery discipline used for cloud services. If internet-facing systems can be found and manipulated by outside actors, then passive assumptions about obscurity no longer hold. The practical governance shift is toward continuous external measurement, enforced remote access design and faster removal of public management surfaces. Teams that still rely on implicit obscurity are operating with a broken trust model.
Named concept: remote-control exposure debt. This is the accumulated risk created when operational devices remain remotely reachable after their intended service window or before they are fully hardened. It grows when ownership is split between facilities, operations and security, leaving no one accountable for closing public access paths. Practitioners should assign explicit ownership for exposed OT interfaces and remove that debt as part of normal security governance.
What this signals
Remote-control exposure debt: once operational systems are reachable from the public internet, the gap between discovery and remediation becomes a live resilience issue. Retailers should expect more attackers to target facility controls that affect food safety, uptime and customer trust, especially where patching is uneven and ownership is fragmented.
The practical response is to fold OT-facing assets into the same external exposure programme used for internet services, then govern them by reachability, firmware state and business criticality. That is the only way to stop a scanned device from becoming an operational incident.
For practitioners
- Map every internet-facing refrigeration controller Create an inventory that records external reachability, firmware version, business location and administrative owner for each controller.
- Block public access to management interfaces Move controller administration behind VPN, jump hosts or private network paths so remote adjustment is not possible from the open internet.
- Separate patched from vulnerable builds Prioritise remediation for devices still on older firmware and track them separately from units already running a patched version.
- Test for unauthorized temperature changes Review logs, alerts and local reporting for unexplained setpoint changes, especially during low-occupancy hours when response is delayed.
Key takeaways
- Internet-reachable refrigeration controllers can be manipulated directly, which makes them a business continuity risk as well as a technical one.
- Exposure data matters because a patched device and a vulnerable device present different levels of immediate risk even when both are online.
- The most effective containment is to remove public management paths and govern external reachability as part of normal operational security.
Related NHI Mgmt Group resources: Small Business Cybersecurity Basics Guide · Cyber Hygiene Checklist Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0001;TA0040 — Initial Access; Impact | Remotely reachable controllers enabled direct manipulation and operational disruption. |
| Recommendation — Map exposed controller activity to TA0001 and TA0040, then detect public interfaces that can alter physical settings. | ||
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems inventory | Controllers must be inventoried before their external exposure can be governed. |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | Remote management access needs explicit authorization controls, not open reachability. | |
| Recommendation — Inventory every internet-facing controller and keep exposure status current in your asset register. Enforce access control on management interfaces so only approved paths can reach operational devices. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | Publicly reachable controllers are a network exposure problem as much as an OT issue. |
| Recommendation — Segment and restrict controller networks so management services are not exposed to the public internet. | ||
Key terms
- Industrial Control Systems: Industrial control systems are the components that directly automate and supervise industrial processes, including controllers, sensors, and supervisory software. They are a subset of operational technology, but they often carry the most sensitive control paths and therefore demand specialised access and monitoring controls.
- Operational Technology: Operational Technology is the hardware and software that monitors or controls physical processes such as manufacturing lines, utilities, and transportation systems. Unlike standard IT, OT prioritises uptime and safety, so identity controls must be precise enough to reduce risk without interrupting essential operations.
- Firmware: Firmware is the embedded software that runs a device at a low level and controls how it behaves. In IoT environments, outdated firmware is a major risk because vulnerabilities can persist for long periods, giving attackers an easy path to compromise devices that are rarely patched like standard endpoints.
- Exposure management: Exposure management is the practice of identifying which assets are reachable by attackers and reducing that reach before exploitation occurs. For collaboration systems like SharePoint, it is not enough to know that a patch exists, because public accessibility changes the speed and likelihood of attack.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.
Published by the NHIMG editorial team on November 4, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org