Internet-exposed refrigeration controllers invite scaling probes and disruption

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Flare's research: Internet-exposed refrigeration controllers were observed across multiple countries, with default passwords and weak network access controls implicated in some incidents.

Why it matters: IAM, remote access and OT security teams should treat internet-reachable controllers as governed access assets, because exposure, credentials and lifecycle decisions shape whether incidents stay local or spread.

By the numbers:

• In France, 612 of 989 retained records, or 61.9%, were last observed before October 13.
• Of the November 1-2 records, 55% of Portugal's retained records were last observed before October 13.
• Of the November 1-2 records, 28% of Belgium's retained records were last observed before October 13.
• The served front-end bundle predates the first 2025 release on 604 hosts, or 76.8%.

Context

Internet-exposed operational technology becomes far easier to misuse when device access is treated as a network problem instead of an identity and governance problem. For remote-access systems, the real issue is not only whether a device is reachable, but whether that reachability is constrained, authenticated and retired on a deliberate lifecycle. This is especially true where vendors, contractors and site operators all touch the same equipment.

The pattern in this research is familiar to organisations that leave remote administration open for convenience. A controller can remain visible long after its operational context changes, and scanner records can outlive the device state behind them. That makes exposed OT a moving governance problem, not a simple inventory snapshot. Treat remote access identity as part of the control plane, not as an afterthought.

Key questions

Q: What should teams do first when refrigeration controllers are exposed?

A: First, remove direct internet reachability and confirm which controllers can be touched remotely. If remote access is necessary, it should pass through segmented, authenticated access with logging, because exposed controllers can be altered without physical entry and the operational impact appears before the compromise does.

Q: Why do default passwords make remote OT access so risky?

A: Default passwords make remote OT access risky because they are widely known, often reused across devices, and frequently left unchanged on internet-reachable systems. If a remote gateway, HMI, PLC or engineering workstation still uses a vendor default credential, an attacker can authenticate without exploiting the device itself, then pivot into operational networks or alter control logic.

Q: How do passive scan records differ from live device exposure?

A: Passive scan records show what a scanner observed at a point in time, such as open ports, banners or service fingerprints. Live device exposure is the current attack surface actually reachable from a network or the internet. Treat scan data as exposure intelligence, then confirm what is still accessible before you prioritise remediation.

Q: What is the best way to control third-party remote access to OT devices?

A: The best way to control third-party remote access to OT devices is to broker it through a PAM or remote access gateway with just-in-time approval, MFA, session recording and per-vendor least-privilege accounts. Access should be time-bound, attributable and revocable, with password vaulting or credential injection instead of shared static credentials.

Technical breakdown

How exposed OT devices become reachable attack surface

Internet-exposed controllers are often found through passive indexing, banner fingerprints and service enumeration rather than direct probing. Once an address answers on common ports, a scanner can retain that host record even after the underlying device changes state, so visibility and availability are not the same thing. The research also shows that multiple services can sit behind the same public address, which complicates attribution of what is actually exposed. In practical terms, surface area is created by addressability, service co-location and weak external filtering, not only by a single vulnerable binary.

Practical implication: Track externally reachable OT assets as governed exposure points, not as static hosts, and remove public reachability when the business need no longer exists.

Why default passwords and unauthenticated remote access matter

Default credentials are especially dangerous on remote-management systems because they collapse the distance between discovery and control. If a device is both internet-reachable and left on known credentials, the attacker does not need a novel exploit to begin interfering with operations. Even when a site is not confirmed compromised, that combination creates a high-probability path to abuse. The same applies to weakly segmented remote access, where a controller can be contacted from outside the operational boundary without strong identity checks or device-specific trust controls. In OT, convenience settings often become standing access paths. See the Remote Access Identity Guide.

Practical implication: Require strong authentication, unique credentials and explicit network containment for every remotely managed controller.

Why scanner data can overstate or understate live exposure

Passive scanning data measures what was observed, not what is currently powered on, reachable or in service. A retained record may reflect index lag, infrequent revisit cycles, shared infrastructure or a device that has already been disconnected. That means raw counts are useful for pattern detection but unsafe for claims about current exposure without host-level reconciliation. The same caution applies when comparing countries or time windows, because collection routes and retention behaviour differ. For defenders, the lesson is that exposure metrics need validation against asset ownership, maintenance records and network telemetry.

Practical implication: Validate external exposure counts against asset and network inventories before using them for risk decisions or board reporting.

Threat narrative

Attacker objective: The attacker objective is to interfere with refrigeration control or disrupt availability at scale, while remaining hidden inside ordinary remote-access exposure.

1. Entry occurs when internet-reachable refrigeration controllers are discoverable through passive indexing and exposed services, including systems that answer on common web or management ports.
2. Credential access becomes feasible where default passwords or weak remote-access controls are present, allowing an attacker to reach device functions without a novel exploit.
3. Impact follows when the controller's operating mode can be altered or its availability disrupted, creating temperature excursions and business interruption across retail sites.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
• CitrixBleed 2 2025: CitrixBleed 2 leaked NetScaler session tokens from memory, letting attackers hijack VPN sessions and skip MFA at 100+ organisations.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Internet exposure is the control failure, not the headline event. Once operational devices are reachable from the public internet, the security boundary moves from the plant floor to remote-access governance. That changes the problem from patch management alone to a broader question of who can reach the device, how that access is authenticated, and when it is removed. For practitioners, the real task is to shrink the reachable estate before an incident forces the issue.

Default credentials on managed equipment create standing operational risk. If a controller can still be accessed with vendor defaults or weak site-specific passwords, the issue is no longer hypothetical. The governance gap is persistent access on systems that were never meant to accept broad external reach, especially when maintenance providers and operators share responsibility. That is why remote access identity must be treated as an operational control, not just an IT convenience.

Stale scanner records create a dangerous illusion of precision. Observed internet exposure is not the same as live reachability, and that distinction matters when organisations build risk narratives from scan data. The post-incident mistake is to assume the count itself proves current condition. For defenders, the better model is asset reconciliation across scans, maintenance records and network telemetry before deciding whether an exposure is truly active.

Exposure lifecycle debt: this is the accumulated risk created when externally reachable industrial devices remain online after their operational role has changed. The article shows that even where incidents are localised, the broader population of reachable controllers is large enough to keep the same failure mode available across regions. Practitioners should treat retirement, credential removal and external reachability as one control family.

What this signals

Exposure lifecycle debt: when operational devices stay internet-reachable after their business need changes, the organisation inherits a long tail of recoverable but unmanaged risk. That debt is most visible in remote-managed environments where contractors, site staff and vendors all depend on the same access path.

OT teams should expect scanner data to be used against them in two ways: as evidence of exposure and as evidence of incomplete governance. The practical response is to collapse public management surfaces, reconcile ownership and make every remote access path disposable when the task ends.

For practitioners

• Inventory internet-facing OT controllers continuously Reconcile scanner results against site inventories, maintenance records and network telemetry so you know which refrigeration controllers are actually reachable.
• Remove default passwords from every remotely managed device Replace vendor defaults with unique credentials, and verify that contractor access uses separate accounts with explicit ownership and revocation paths.
• Block unnecessary public management access Segment management traffic, restrict inbound access to approved sources and retire public exposure when remote administration is no longer required.
• Validate scan data before using it as exposure evidence Treat passive indexing as a starting point, then confirm live state with local logs, asset owners and change records before making operational decisions.

Key takeaways

• Internet-facing refrigeration controllers become a governance problem as soon as remote access, default credentials or weak segmentation allow them to be reached from outside the operational boundary.
• Passive scan data is useful for identifying exposed assets, but it cannot prove current reachability or device state without reconciliation against inventories and telemetry.
• The strongest control is not a single security setting but the combination of access removal, credential hygiene and retirement of public management paths.

Related NHI Mgmt Group resources: Remote Access Identity Guide · Post-Incident Review and Root Cause Analysis Template · VPN Protocols Compared: WireGuard, IPsec, OpenVPN Guide

Key terms

• Remote Access: Remote access is the ability for a user or system to reach applications, devices, or data from outside the local network. In identity security, it relies on strong authentication, least privilege, session control, and monitoring to reduce exposure from stolen credentials, unmanaged endpoints, and insecure network paths.
• Operational Technology: Operational Technology is the hardware and software that monitors or controls physical processes such as manufacturing lines, utilities, and transportation systems. Unlike standard IT, OT prioritises uptime and safety, so identity controls must be precise enough to reduce risk without interrupting essential operations.
• Default Password: A default password is the manufacturer-supplied credential that ships with a device before it is configured by the operator. In industrial environments, leaving defaults unchanged creates a predictable entry point for attackers who know the manuals and common settings. It is one of the simplest and most preventable causes of device exposure.
• Passive Scanning: Passive scanning reviews application traffic without changing requests or trying to exploit anything. It is useful for low-risk inspection of HTTP interactions, headers, and response patterns. Because it does not actively attack the application, it is safer than active testing, but it also misses many vulnerabilities that require crafted input or exploit attempts.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps practitioners connect access lifecycle controls to the operational systems their programmes depend on.