TL;DR: Internet-exposed refrigeration control systems can be manipulated through legitimate supervisory functions, creating physical and financial harm without destructive malware, according to Forescout, while tracking 12,976 exposed services across 6,017 public IPs in 99 countries and territories. The security problem is not just exposure, but weak ownership of remote maintenance, stale contractor access, and unaudited changes to setpoints and defrost schedules.
At a glance
What this is: Forescout analyses attacks on internet-exposed refrigeration control systems and finds that ordinary remote management functions can be abused to cause physical and financial damage without malware.
Why it matters: IAM, PAM, and operational security teams need to treat contractor credentials, remote maintenance paths, and change logging as part of the control plane for physical systems, not just IT access.
By the numbers:
- The French incidents were reported across more than 700 supermarkets in the country.
- Since January 2026, tracking identified over 20 claimed attacks against refrigeration systems.
- One vendor bulletin described attacks in 2022 that affected 16 Russian supermarkets and 40 Israeli stores.
Context
Refrigeration management systems sit at the boundary between operational technology and identity governance. When remote maintenance is exposed to the public internet, the control question is no longer only whether the device is reachable, but who can authenticate, what they are allowed to change, and whether those changes are attributable.
The article shows that this exposure is not merely accidental. Manufacturer documentation had already anticipated internet-based remote maintenance for some platforms, which means the governance gap is in operational ownership, permission design, and session evidence rather than in remote access alone.
Key questions
Q: What breaks when remote maintenance on OT systems is exposed without strong identity controls?
A: The boundary between legitimate administration and hostile manipulation collapses. When a remote maintenance path can change setpoints or schedules without named identities, MFA, role scoping, and session logging, the organisation cannot prove who made a change or whether it was authorised. That creates operational risk, weakens incident triage, and allows routine maintenance traffic to hide abuse.
Q: Why do contractor credentials create outsized risk in remotely managed industrial systems?
A: Because contractors often have broad, repeated access across multiple sites, and those accounts can persist longer than the business relationship that justified them. If credentials are shared, stale, or reused, one compromise can span many facilities and make attribution difficult. The risk is amplified when the system itself is designed for legitimate remote intervention.
Q: What are the signs that a remote operational control system is being abused?
A: Look for access sessions that coincide with unusual combinations of parameter changes, repeated configuration updates in a short period, changes outside normal maintenance windows, and actions that do not match expected site behaviour. In these environments, the best indicator is not just a failed login. It is an authorised session producing an operational state that does not fit the process baseline.
Q: How should organisations balance remote access convenience with control of critical facilities?
A: They should keep remote maintenance, but move it behind a governed access boundary that assigns ownership, limits privilege, and preserves audit evidence. The right model is not unrestricted connectivity, and it is not eliminating remote support entirely. It is making every maintenance path attributable, reviewable, and correlated with physical process changes.
Technical breakdown
Why exposed refrigeration HMIs create an access-control problem
A refrigeration HMI or supervisory interface is not just a dashboard. It is a control surface that can alter temperature, alarms, defrost cycles, users, and sometimes downstream network settings. If that interface is internet-facing, the security boundary shifts from perimeter filtering to authenticated, role-scoped, and logged control of physical operations. In practice, the danger is not only unauthorized login. It is authorized access being too broad, too hard to attribute, or too easy to reuse across sites and contractors. When the same interface can influence several stores or facilities, one credential can have outsized operational reach. See the [[L2|Third-Party Risk Management Guide]]. See the Third-Party Risk Management Guide.
Practical implication: treat each remote maintenance path as a privileged access route with explicit ownership, scope, and audit requirements.
How legitimate remote maintenance becomes the attack path
The article’s central technical point is that attackers do not need to invent a new exploit to cause harm. They can abuse normal supervisory functions when authentication is weak, shared, or stale, or when known vulnerabilities remain unpatched on exposed systems. That makes the security problem closer to privileged abuse than to classic destructive malware. If remote access is supported through port forwarding, public IPs, or legacy XML connections, the control surface expands further. The result is a system where a routine contractor workflow can be indistinguishable from hostile activity unless the organisation can prove who connected, from where, and to change which setting. See the [[L3|Open Source Security Guide]]. See the Open Source Security Guide.
Practical implication: require named contractor identities, MFA, and session-level logging before exposing any supervisory interface.
Why configuration changes need process correlation, not just logs
The hardest part of detecting abuse here is that malicious activity can look operationally normal. A temperature change or defrost adjustment is a legitimate function, so the control cannot stop at recording that a session occurred. It has to correlate access with what changed, when it changed, and whether the physical process outside the interface still makes sense. That means combining remote-access telemetry, controller change records, alarms, and independent process monitoring. Without that correlation, an attacker can hide inside routine maintenance noise, especially across multisite environments where contractors manage repeated configurations. See the [[L7|Network Ports and Protocols Security Guide]]. See the Network Ports and Protocols Security Guide.
Practical implication: alert on unauthorized combinations of access session, setpoint change, and unexpected process behaviour.
Threat narrative
Attacker objective: The objective is to disrupt operations or create leverage for extortion by manipulating refrigeration systems through legitimate controls.
- Entry occurs through internet-exposed refrigeration management interfaces, often via exposed remote maintenance paths or weak authentication.
- Credential or access abuse follows when shared, stale, or weak contractor identities allow an attacker to use legitimate supervisory functions.
- Impact occurs when the attacker changes temperature, defrost, alarms, or configuration settings, causing food loss and operational disruption.
Breaches seen in the wild
- CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Publicly reachable refrigeration control is a privileged access problem, not just an OT exposure problem. The article makes clear that remote maintenance can legitimately change setpoints, alarms, and defrost schedules, which places these systems inside the identity and privilege boundary. That means ownership, authentication, and auditability matter as much as network reachability. The practitioners who treat these interfaces as ordinary web assets will miss the real control gap.
Shared contractor access is the named failure mode here. The risk is not only that a credential exists, but that maintenance access is often distributed across contractors, facilities teams, and IT teams without a single accountable owner. Third-Party Risk Management Guide is relevant because offboarding, role scoping, and fourth-party visibility are central when access spans multiple sites. The practical lesson is that identity lifecycle governance must extend into OT service relationships.
Legitimate function abuse is the concept this incident sharpens. Attackers did not need destructive malware to create damage because normal supervisory commands were enough to alter physical outcomes. That makes change attribution and baselining the central governance issue. Organisations should assume that operationally valid actions can still be adversarial when they arrive through the wrong identity, at the wrong time, or from the wrong location.
This pattern validates the need for a security boundary that includes the physical process, not just the login screen. If the organisation cannot correlate session logs with process changes, it cannot tell maintenance from manipulation. That is a control failure in both PAM and OT monitoring terms, and it should change how remote access is approved, logged, and reviewed.
The broader market signal is that internet-exposed industrial and facility controls are becoming identity-rich attack surfaces. The more a supervisory platform can be reached remotely, the more it inherits the same governance problems seen in NHI and contractor access: scope creep, credential reuse, and weak attribution. Practitioners should treat these systems as part of their privileged access estate, not as isolated operations tools.
What this signals
Legitimate function abuse in OT is becoming a repeatable pattern. The key challenge is not whether a control interface is technically exposed, but whether the organisation can distinguish authorised maintenance from manipulation at the identity and process layers. Where contractor access, public reachability, and weak attribution overlap, the governance problem becomes persistent rather than episodic.
Remote maintenance needs the same governance discipline as privileged IT access. That means treating service paths, named identities, and session evidence as operational controls, not as administrative afterthoughts. When facilities, contractors, and IT split accountability, the attack surface expands faster than any one team’s visibility.
For practitioners
- Remove direct public exposure Take refrigeration management interfaces off the public internet and restore remote maintenance through a secure remote access gateway with explicit approval boundaries.
- Eliminate shared contractor credentials Replace shared or stale maintainer accounts with named identities, MFA, least privilege, and session logging for every remote maintenance path.
- Map the full control path Inventory public endpoints, routers, VPNs or gateways, supervisory platforms, downstream controllers, sites, contractors, and accountable owners.
- Correlate access with process changes Compare remote-access sessions against defrost schedules, alarms, setpoints, users, and network configuration to flag suspicious combinations.
- Replace unsupported supervisory systems Patch devices that can be patched and plan replacement for end-of-life controllers that cannot be remediated.
Key takeaways
- The central risk is not malware but the misuse of valid supervisory functions on publicly reachable refrigeration systems.
- The article ties this pattern to more than 12,976 exposed service observations across 99 countries and to incidents affecting more than 700 supermarkets.
- The most effective control is a governed remote access boundary with named identities, least privilege, session logging, and process correlation.
Related NHI Mgmt Group resources: Third-Party Risk Management Guide · Software Supply Chain Security Guide · Open Source Security Guide · CircleCI breach 2023
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5, CIS Controls v8 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Remote maintenance access and contractor privilege are central to the attack path described. |
| Recommendation — Apply PR.AA-05 to scope remote maintenance rights to named identities and least privilege. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article highlights stale, shared, and weak maintainer credentials on exposed systems. |
| Recommendation — Use IA-5 to enforce credential lifecycle controls for all remote supervisory access. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account sprawl and unclear ownership are key contributors to this exposure pattern. |
| Recommendation — Use CIS-5 to inventory, assign, and remove accounts that can reach operational control systems. | ||
| MITRE ATT&CK | TA0006; TA0040 — Credential Access; Impact | The attacks rely on access abuse and end in disruptive operational impact. |
| Recommendation — Map observed activity to TA0006 and TA0040 to prioritise defensive detections around credential abuse and disruption. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | Cloud-adjacent remote maintenance and access governance are directly relevant to exposed supervisory platforms. |
| Recommendation — Apply IAM controls to govern identities that can reach remotely managed industrial systems. | ||
Key terms
- Legitimate Function Abuse: The misuse of normal, allowed system functions to create harm, evade detection, or change physical or digital outcomes. In operational environments, this is often more dangerous than obvious malware because the activity can look like routine administration unless access, change, and process signals are correlated.
- Remote Maintenance Gateway: A controlled access path that brokers contractor or operator connections to systems that should not be directly exposed to the public internet. It narrows authentication, logging, and session oversight to one governed boundary instead of letting maintenance traffic reach the device directly.
- Process Correlation: The practice of comparing access events with the underlying operational state of a system so that valid commands can still be evaluated for abnormality. It is essential where a legitimate login can trigger physical change, because the action itself may be permitted even when the context is not.
- Contractor Identity: A contractor identity is the digital representation of an external worker who needs access to systems, data, or tools for a defined business purpose. It should be treated as a time-bound identity with explicit ownership, scope, and removal rules, not as a casual exception to employee IAM.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management in a way that helps teams separate legitimate access from persistent risk. It is suitable for practitioners who need to connect identity controls to broader security and operational programmes.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org