Refrigeration Cyberattacks Expose a Major OT Security Gap

The Alarm Worked. The Attack Still Got In. Are You Breach Ready for This?

On November 2, attackers pushed the controls of French blood bank cold rooms toward dangerous heat. The alarms fired and staff responded. No blood products were lost.

The French blood service deserves applause. Detection did its job.

But here is what worries me. The attack hit a refrigeration supplier first, then reached the systems controlling the cold rooms. In the same wave, supermarket refrigeration in at least six European countries was hit.

Detection tells you something is burning.

It does not stop the fire from reaching the next room.

The Next Attack Will Not Need Exotic Malware

Look at 2026 across sectors.

Water. The FBI and EPA warn that since July 27, utilities in at least seven states reported attacks on internet-facing Rockwell MicroLogix 1100 and 1400 PLCs. Some degraded operations.

Food. On November 5, CISA and partners warned that attackers can force refrigeration units into continuous heating and defrost cycles. The result is inventory loss.

Oil and gas. In August, the FBI and Coast Guard boarded two tankers bound for Texas and found malicious activity on one. Officials reported no operational disruption. Their concern is ships joining IT networks to onboard control systems.

Transportation. South Africa’s air navigation provider ATNS reportedly found ransomware-linked malware in its OT networks in September.

Hospitals. Winnipeg’s Health Sciences Centre was hit by ransomware in door access and ventilation systems. Clinical care continued on manual control.

Notice the pattern. Exposed controllers. Remote connection points. Building systems nobody inventoried.

This is not a zero-day story. It is a reachability story. And it is going on.

AI Makes the Hard Part Cheap. It Also Breaks Things

Dragos recently tested and published a report about two frontier models in its cyber ranges. The models mapped OT networks, wrote their own EtherNet/IP tooling, validated known flaws, and found new zero-days. Dragos assesses with moderate confidence that this lowers the barrier for less-skilled actors.

Then came the part I want every operator to read twice.

During testing, one model crashed a MicroLogix PLC.

Another action took down an HMI’s FTP service.

The same PLC family is in the FBI warning above.

Booz Allen saw similar speed. In its isolated lab, frontier models met all eight objectives. One went from perimeter compromise to actions inside an industrial control network in just over 16 minutes.

Humans approved physical actions, and the models were unnamed. It was a lab, not a plant.

Dragos is also clear that models still need expert correction and produce false positives. Good. But an attacker’s AI does not need to be right. It needs to be fast and unsupervised. Sometimes that means it breaks what it touches.

Here is the stark reality.

You cannot out-patch a machine. You can make the unpatched unreachable.

Seeing Is Not Stopping. Visibility ≠ Containment

Most OT security budgets bought visibility.

That was the right first step. But that was the first one.

Without the ability to act on what you see, the investment in visibility is useless.

Microsoft Defender for IoT watches a mirrored copy of OT traffic, so it does not touch the plant. It inventories assets, flags vulnerabilities and anomalies, and feeds Sentinel and Defender XDR. CrowdStrike Falcon for XIoT adds zero-touch asset discovery and visibility into segmentation violations, alongside EDR for supported OT endpoints and managed detection.

Both are strong at seeing. Dragos notes that the models’ scans and malformed requests across EtherNet/IP, FINS, Modbus, and OPC UA are detectable if someone watches.

But watching is a human-speed activity. Seeing a microsegmentation violation is not the same as enforcing the boundary.

And the boundaries are thin. Forescout analyzed 47,700 network segments. Of segments containing OT devices, only 13% held OT devices alone. For segments with medical devices, only 6% were medical-only.

Here is what every CISO must remember from cybersecurity basics. A sensor can tell you the door is open. It cannot close it.

Five Steps to Stop the Next Attack from Spreading

1.  Define what must keep running. Name the cold rooms, ventilation pressure, navigation, signaling, and chlorination that cannot fail. Agree with the board on the impact you will accept. You cannot protect what you have not ranked.
2.  Pull controllers off the internet and vendors off standing access. Inventory every internet-reachable controller, including facilities-owned ones. Replace always-on vendor access with approved, time-boxed, monitored sessions. Every open path is an invitation.
3.  Build islands, not flat networks. Define zones with microsegments based on loss impact and affordable exposure, interconnected by software-controlled conduits in the spirit of ISA/IEC 62443. Deny by default between IT, OT, building systems, and vendors. Your fridge controller will never talk to your email.
4.  Pre-authorize containment. Decide in writing who can isolate a plant, ward, or vessel segment, and when. Connect your detection tools to enforcement, so an alert triggers a boundary, not a ticket. Automate where it is practical. Put a time limit on human-in-the-loop for those you cannot automate. Containment you have never tested is a hope, not a control.
5.  Rehearse manual mode. Winnipeg’s staff ran doors and air handling by hand. That is a control. Drill it, with an adversary that moves in minutes, and measure time to contain, not time to detect. And do not forget to include the no-tech CXOs in your drills. They are the ones who would talk to the business stakeholders.

None of this requires predicting which AI the attacker uses.

Breach readiness is architecture, not prophecy.

Questions for Your Next Board Meeting

• If an attacker held our vendor’s remote access tonight, which controllers could they reach?
• Which refrigeration, HVAC, or building systems are missing from our asset inventory?
• Do our detection tools trigger containment, or only alerts?
• Who can isolate a site, and when did we last practice?
• If our IT network fell tonight, what would still run tomorrow morning?

If your answers are vague, that is your gap. Not your tooling. Your architecture.

My Recommendation

Every cyberattack either causes severe impact (unless stopped) or becomes a learning moment for attackers.

If you are a CISO of an organization that uses refrigeration systems and has not been affected yet, remember: it is no longer if, but when. Start today to build your digital architecture like a Zero Trust practitioner.

Stop wondering:

“How fast can we detect the attack?”

Start working on:

“How far can it spread, and how fast, before we stop it or slow it down?”

Map what must keep running. Close the exposed paths. Segment every route to it. Pre-authorize the response. Rehearse it by hand.

The next attack will arrive faster than your analyst.

Your architecture has to be ready for a breach before anyone is awake to read the alert.

Contact us to discuss how you can limit attack spread and keep critical operations running.