If you tried to place a grocery order with Stop & Shop, Food Lion, or Giant this week, you found the site down. Parent company Ahold Delhaize shut systems off after what it described as a security issue. Stores stayed open, unfulfilled online orders are being refunded, and the company says it has no evidence that customer or employee data was taken. The cause has not been disclosed.
The same week, in France, something more instructive happened. On the night of October 11, attackers took control of refrigeration systems at supermarkets across the country and forced them into continuous defrost. Freezers climbed toward 50°C over roughly six hours. Stores threw out meat, frozen goods, and produce. Two stores in Alsace alone reported €270,000 in losses. In some locations the overheated equipment started fires. The French finance minister told Parliament that roughly 700 of the country’s 10,000 supermarkets were affected, that food supplies were never at risk, and that the attack still reached the heart of national food security. He called it a wake-up call.
There was no ransomware note. No stolen credentials. No executive tricked into wiring money. Just devices that control temperature, connected to the internet, running software that was years past its prime.
| Quick Answer: The most expensive IoT security risks are rarely sophisticated. The French supermarket refrigeration attack worked because controllers that manage physical equipment were reachable from the public internet and running unsupported firmware with known vulnerabilities. The defenses are equally unglamorous: a complete inventory of connected devices, IoT network segmentation away from critical systems, controlled vendor remote access, and an enforced end-of-life policy for hardware the manufacturer no longer patches. |
The IoT Attack Surface You Forgot to Count
Nobody in IT thinks of a walk-in freezer as a network endpoint. That is exactly the problem.
Supermarket cold aisles are run by a central controller that manages every fridge and freezer in the store. Those controllers are deliberately reachable over the internet so maintenance contractors can adjust settings without driving to the site. That is a reasonable operational decision. It is also a decision that quietly moved the store’s perimeter from the server closet out to a box on the wall behind the dairy case.
France’s cybersecurity agency said it was aware of numerous compromises involving refrigeration remote control modules from two manufacturers, Danish company Danfoss and US-based Copeland. Operators were told to disconnect the devices or tightly filter access to them. That instruction is only necessary because the devices were reachable in the first place.
Every connected device you add does the same thing. Badge readers. HVAC. Cameras. Digital signage. Building management panels. Each one is a host with an IP address, a software stack, and an owner who may or may not still be shipping patches.
Most IoT Vulnerabilities Are Boring
In August, the security firm Claroty published research on vulnerabilities in the Danfoss AK-SM 800A and Copeland XWeb Pro platforms, both used to manage refrigeration infrastructure in supermarkets, warehouses, and similar facilities. Claroty reported that numerous controllers running the Danfoss system were directly accessible from the public internet. Both vendors subsequently issued fixes.
Danfoss has said most affected systems were older products no longer receiving software or security updates, and that it has long advised customers to keep supported systems on current firmware and run them behind a firewall. Copeland said the vulnerability sat in a discontinued, end-of-life generation of controllers.
A homeland security professor at Virginia Commonwealth University who studies these attacks said carrying one out is not especially difficult, and that the controls here were almost certainly left open to the broader network the supermarket was using.
So the warnings existed. The patches existed. The guidance existed. What was missing was anyone whose job it was to notice that a refrigeration controller is a computer.
That is the uncomfortable part. Most of the incidents that actually cost you money are not elegant. They are an unsupported device left exposed, a default credential nobody changed, a system that fell off the asset list when the person who installed it left the company. Attackers do not need to invent anything. They need to find the one thing you stopped looking at.
Operational Technology Security Is Not a Grocery Problem
Food retail got the headline, but the pattern is industry-agnostic. Manufacturing has PLCs. Healthcare has infusion pumps and imaging equipment. Hospitality has door locks and energy management. Logistics has cold chain monitoring. In each case the device is operational technology, it is procured by facilities or operations rather than IT, and it is supported by a vendor or contractor with remote access.
This is also not new. Attacks on water systems, power infrastructure, and other physical operations have been common for years. Minnesota and Michigan both reported cyberattacks on state water systems over the summer. And last month, three military agencies were reportedly investigating refrigeration outages at US military commissaries that happened within days of each other. What made the French case unusual was its scale, and the absence of any ransom demand or data theft.
When an operational device is compromised, the loss is physical and immediate. You are not restoring from backup. You are discarding inventory, calling insurance, explaining empty shelves to customers, and in the French case, calling the fire department.
There is also a dependency question worth asking out loud. Les Mousquetaires noted that the refrigeration systems were under the supplier’s management. If a third party holds remote access to a system that can cause physical damage in your facility, their security posture is your security posture.
How to Reduce Your IoT Security Risk
- Build a real inventory. Not a list of laptops and servers. Every connected device, including the ones procured by facilities, operations, or a vendor. If you cannot name the device, its firmware version, and who patches it, you do not control it.
- Get operational devices off the public internet. Remote vendor access should run through a VPN or a brokered access path with logging and MFA, never a management interface exposed to the open web.
- Use IoT network segmentation. IoT and OT belong on their own VLANs with explicit rules about what they can reach. A compromised thermostat should not be able to see your POS systems or your domain controllers.
- Set an end-of-life policy and enforce it. Unsupported hardware is a decision, not an accident. If you cannot replace it this year, isolate it and monitor it as if it is already compromised.
- Put third-party access under contract. Require vendors to document how they connect, who on their side has credentials, their patch cadence, and their notification obligation when a flaw is disclosed.
- Monitor behavior, not just availability. A controller running defrost for six straight hours instead of the usual two is an anomaly. Something should have caught that before the food did.
Two Attack Paths, One Program
Most security conversations center on people. Attackers manipulate trust, authority, and urgency, and AI has made that cheap enough to run against everyone. We covered both sides of that in detail recently.
The first is the attacker’s view: social engineering attacks now run at scale, and every company is in range. The second is the program view: human risk management assumes mistakes will happen and builds detection, least privilege, and fast reporting around them.
The refrigeration attacks show a third path, where no employee decision was involved at all. The device was reachable, the firmware was old, and nobody had to be fooled. A security program needs to cover both. Layer 8 gets the attention. The devices nobody assigned to anyone are where the quiet exposure sits.
Security spending tends to follow the scary story: nation-state actors, novel malware, AI-enabled phishing. Those are real. They are also not what emptied hundreds of freezers last weekend. The gap in most organizations is an incomplete picture of what is actually connected, who can reach it, and whether anyone is still patching it. That is unglamorous work, and it is the work that would have prevented this.
How Amplix Can Help
Amplix’s cybersecurity practice helps organizations find and close this kind of exposure. That includes security risk assessments that show leadership where exposure actually sits, assessments and testing that put your environment under realistic pressure, network and infrastructure work to segment what needs segmenting, incident response planning for when something does get through, and vCISO leadership without the cost of a full-time executive.
Contact Amplix if you are not confident you could produce a complete connected-device inventory this week. That is the place to start.
Frequently Asked Questions
What are IoT security risks for businesses?
IoT security risks come from connected devices that sit outside normal IT governance: building controls, cameras, badge readers, HVAC, refrigeration, and sensors. These devices often run unsupported firmware, carry default or weak credentials, are reachable from the public internet for vendor maintenance, and are missing from the asset inventory. When one is compromised the damage is frequently physical and immediate, such as spoiled inventory or halted production, rather than a data breach.
How do you secure IoT devices?
Start with a complete inventory of every connected device, its firmware version, and its patch owner. Remove management interfaces from the public internet and route vendor access through a VPN or brokered access path with MFA and logging. Change default credentials, place the devices on segmented networks, apply firmware updates on a defined cadence, and set an end-of-life policy so unsupported hardware is replaced or isolated rather than left running.
How does network segmentation improve security?
Network segmentation limits what a compromised device can reach. If IoT and operational technology sit on their own VLANs with explicit allow rules, an attacker who takes over a thermostat or a camera cannot pivot to point-of-sale systems, file servers, or domain controllers. Segmentation does not prevent the initial compromise, but it converts a potential enterprise-wide incident into a contained one.
How do I segment IoT devices on an OT network?
Group devices by function and criticality, place each group on its own VLAN, and write explicit allow rules for the few flows each group actually needs, such as a controller reaching its vendor’s update server. Deny everything else by default, including lateral traffic between IoT segments. Terminate vendor remote access at a jump host inside the segment rather than exposing the device directly, and log all cross-segment traffic so anomalies are visible.
Are IoT devices a security threat?
Connected devices are not inherently a threat, but they expand the attack surface and are commonly governed less rigorously than servers and laptops. They are often purchased by facilities or operations teams, supported by a third party, and never added to the security program. That gap, rather than the technology itself, is what makes IoT devices a reliable entry point.
How do you evaluate IoT device security before buying?
Ask the vendor for a published support lifecycle with firmware end-of-life dates, their vulnerability disclosure and patch history, whether the device supports certificate-based authentication and MFA, how remote maintenance access works, and what logging the device produces. Put notification obligations and patch cadence into the contract, and confirm the device can function on a segmented network without internet exposure.
