French refrigeration hacks expose the OT exposure gap in supermarkets

At a glance

What this is: This is an OT and IoT security analysis of French supermarket refrigeration controller compromises that turned remote access exposure into physical disruption.

Why it matters: It matters because identity, access and segmentation gaps on embedded systems can translate directly into operational outage, spoiled inventory and broader lateral movement risk.

By the numbers:

• The incident affected approximately 700 facilities and caused millions of euros in spoiled food.

Context

Connected OT and IoT devices often sit outside the controls that protect traditional IT assets. When management interfaces are reachable from the public internet, a routine maintenance channel becomes an attack surface, and attackers can change physical settings without needing deeper network access.

This article focuses on refrigeration controllers because they show how access exposure, weak defaults and limited segmentation combine into operational loss. The identity angle is real here: remote access to embedded systems still depends on credentials, trust boundaries and administrative pathways, even when the device is not a classic user endpoint.

Key questions

Q: What breaks when refrigeration controllers are exposed to the internet?

A: When refrigeration controllers are directly reachable from the internet, attackers can target the management plane instead of the data plane. That turns routine configuration access into a physical disruption path, where changing setpoints or defrost schedules can spoil inventory, interrupt operations and create expensive recovery work.

Q: Why do compromised credentials and weak remote access controls create such high risk in OT networks?

A: OT environments often rely on remote access paths that reach systems controlling physical processes, so weak credentials become a direct path to operational disruption. Once an attacker gets in, they may encrypt systems, alter process settings, or disable critical services. In these environments, identity failure is not just an IT issue. It can become a safety, availability, and business continuity incident.

Q: What are the signs that an IoT or OT device is outside your security model?

A: The clearest signs are public IP exposure, default or shared credentials, unmanaged third-party access and devices that can be changed without a formal approval path. If you cannot name the owner, the access method and the network boundary, the device is already operating outside a defensible model.

Q: Should organisations prioritise segmentation or patching first for embedded devices?

A: For embedded devices that are hard to patch or have long replacement cycles, segmentation usually delivers faster risk reduction because it limits blast radius immediately. Patching still matters, but the first decision should be whether the device is reachable from places it should never be, especially the public internet.

Technical breakdown

Why exposed management interfaces become an attack path

Refrigeration controllers are embedded operational systems that expose administrative interfaces for monitoring and remote support. When those interfaces are reachable from the public internet, the security model depends on the strength of the login path and the surrounding network boundary, not on the device being obscure. Attackers do not need a complex exploit if the interface is simply exposed and weakly protected. In OT environments, that exposure is especially dangerous because the controller is tied to a physical process, so a small configuration change can produce immediate real-world impact.

Practical implication: remove direct internet exposure from any controller management plane and require authenticated, segmented remote access.

How temperature and defrost settings turn into business impact

A refrigeration controller governs compressor cycles, defrost schedules and temperature alarms. Those are operational parameters, but they also become attack levers when remote access is not tightly controlled. Changing a setpoint or defrost timer can trigger spoilage, equipment stress and store disruption without touching corporate data. That is why OT incidents often bypass classic confidentiality-first thinking. The attack objective is not theft but physical and financial disruption, and the control gap is the absence of sufficient protection around the management function itself.

Practical implication: treat configuration privileges on operational devices as high-risk access and review them with the same discipline as privileged IT access.

Why segmentation and discovery matter for device security

Many organisations cannot defend what they have not inventoried, especially when third parties install or maintain devices over long lifecycles. Discovery is the first control because exposed assets are often the easiest to exploit. Segmentation then limits blast radius by preventing a compromised controller from reaching adjacent systems or traversing into broader networks. In OT and IoT, discovery, exposure assessment and segmentation have to work together because patching alone is not fast enough and replacement cycles are long. Without that combination, one compromised embedded device can remain a local nuisance or become a wider operational incident.

Practical implication: build an authoritative inventory of all OT and IoT assets, then enforce network segmentation for anything that cannot be fixed quickly.

Threat narrative

Attacker objective: The objective was to cause operational disruption and financial loss by manipulating refrigeration systems at scale.

1. Entry occurred through remotely reachable refrigeration controller management interfaces that should not have been exposed directly to the public internet.
2. Credential or access weaknesses allowed the attackers to alter controller settings rather than simply observe them.
3. The attackers escalated the impact by changing operational parameters such as temperature and defrost behaviour, which turned access into physical disruption.
4. The result was spoiled food, disrupted supermarket operations and a broader reminder that embedded device exposure can create immediate business damage.

Breaches seen in the wild

• Verkada camera breach 2021: Admin credentials on Verkada's exposed Jenkins support server let hackers into a support interface and customer cameras at 97 customers.
• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Exposed device management is the real control failure here: the core problem is not that the attackers understood refrigeration, but that the controllers were reachable where they should not have been. When an embedded device accepts remote administration over an exposed channel, the trust boundary has already failed. Practitioners should read this as a governance issue around administrative reachability, not as a niche retail problem.

OT identity is still identity: these incidents show that credentials, remote admin pathways and third-party access are still the decisive control points in embedded environments. If the management plane is weakly authenticated or poorly segmented, the physical process becomes reachable by anyone who can discover the interface. The practitioner conclusion is to govern device access as privileged access, even when the endpoint is a refrigerator controller.

Blast-radius control is the decisive variable in connected operations: when patching is slow and device lifecycles are long, segmentation and exposure reduction matter more than reactive cleanup. The article reinforces a named concept: operational exposure gap, the distance between a device that performs a physical function and the controls that actually restrict who can change it. The practical conclusion is to close that gap before the next controller becomes reachable.

Inventory discipline determines whether OT risk stays visible: third-party installation and maintenance make asset sprawl a governance problem as much as a technical one. If the organisation cannot account for every controller, it cannot know which devices are public-facing, end-of-life or still using default access assumptions. The practitioner conclusion is to treat OT discovery as a prerequisite for any credible resilience programme.

Attackers do not need data theft to create a breach narrative: this case demonstrates that physically meaningful disruption can be the primary outcome even when no sensitive records are stolen. That shifts prioritisation toward access governance, segmentation and configuration management for connected assets. The practitioner conclusion is to measure control effectiveness by containment and recoverability, not just by whether data left the environment.

What this signals

Operational exposure gap: connected devices fail when the management channel is treated as a convenience feature instead of a privileged control surface. For readers, the programme implication is to close public reachability before relying on patch cadence or alerting, because physical systems often cannot absorb the same exposure window as IT assets.

The lesson scales beyond supermarkets. Any embedded device that performs a physical function, depends on remote administration and survives for years without robust identity governance should be treated as a containment problem first and a vulnerability problem second.

For IoT and OT teams, the priority shift is clear: prove inventory, restrict administrative access and enforce segmentation before the next device becomes the easiest path to operational disruption.

For practitioners

• Remove direct internet exposure from device management Move every refrigeration, HVAC and building-control management interface behind VPN access or isolated internal networks, and confirm no public IPs remain reachable.
• Inventory all connected operational devices Create and maintain an authoritative list of every OT and IoT asset, including units installed or maintained by third parties, so exposed devices can be found before attackers do.
• Review privileged settings on controllers Check setpoints, defrost schedules, security modes and default credentials on devices that cannot yet be replaced or patched, because those values are direct attack levers.
• Segment devices that cannot be remediated quickly Use network segmentation and isolation policies so a compromised controller cannot pivot into other store, building or enterprise networks.
• Prioritise devices by exposure and exploitability Rank controllers by internet reachability, patch status and known active exploit exposure instead of relying only on generic vulnerability scores.

Key takeaways

• The incident shows how exposed management interfaces on embedded systems can turn routine remote administration into physical disruption.
• The reported impact reached about 700 facilities and millions of euros in spoiled food, showing that OT compromise can be materially expensive without data theft.
• The control lesson is to remove public exposure, govern privileged access to controllers and use segmentation to limit blast radius.

Key terms

• Operational Exposure Amplification: Operational exposure amplification is a deployment effect where a standard component becomes riskier because the operator increases the chance that a latent defect will be triggered. It usually appears when custom runtime behaviour, timing, or recovery logic diverges from the software's most tested path.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Management Plane: The administrative layer used to configure, govern, and enforce behaviour across many endpoints or services. A management plane is not the workload itself. It is the control layer above it, which makes it especially sensitive to privileged misuse and delegated automation.
• Internet-Exposed Asset: An internet-exposed asset is any system, service, or application that can be reached from the public internet. These assets require tighter monitoring because they are easier for attackers to discover, probe, and exploit. Exposure alone is not a vulnerability, but it increases the importance of patching, configuration control, and validation.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management and workload identity. It helps identity and security practitioners translate access control principles into governed machine and service access.