The cybersecurity industry does not need another reason for security leaders to lose sleep, but for those of you who crave insomnia, attackers are happy to feed your craving.

The recent attacks against supermarket refrigeration systems across Europe generated predictable headlines about vulnerabilities, connected devices, and the growing risks facing operational technology (OT) environments. Those discussions are certainly important, but if your first thought is “refrigeration systems can be hacked,” you’ve missed the bigger lesson.

The real issue is that many organizations still don’t understand which systems actually run their business, but attackers most assuredly do and they’re just itching to show you.

OT Isn’t Just Heavy Machinery

When people hear “operational technology” or “industrial control systems,” they often imagine manufacturing plants, power generation facilities, or other types of massive industrial equipment. Those are certainly examples of OT, but they’re not the only examples.

Consider a healthcare provider: If MRI or CT scanning becomes unavailable, patient care is immediately disrupted. For a financial services firm, trading systems may be the assets that directly enable revenue generation. For a supermarket chain, refrigeration infrastructure is what allows frozen and chilled products to be sold safely. While they aren’t traditionally seen as critical infrastructure or industrial control systems, if those systems go offline that means business operations go offline. That’s Operational Technology.

By comparison, many IoT devices support the business rather than operate the business. Security cameras, environmental sensors, digital signage, or smart building controls are important. Their loss can be disruptive and inconvenient, and you learn how inconvenient their loss is when it’s summer and you’re a bank teller who’s still working in a branch that hasn’t had functioning air conditioning for 3 days. But the disruption of IoT devices typically doesn’t stop revenue generation. That distinction matters and should influence how organizations prioritize protection strategies.

The Vulnerability Is Only Half The Story

Research into the Danfoss refrigeration weaknesses provides valuable insight into the vulnerabilities involved and the techniques used by attackers. Security professionals should absolutely review the technical findings because they were pretty wild and you’ll catch yourself saying “Are you kidding me?”

But focusing exclusively on the vulnerabilities overlooks the reality that these systems were reportedly accessible from the internet and it didn’t require an initial network breach to compromise them. In 2026, that shouldn’t be a controversial statement. This reminds of the water treatment PLC’s that were directly exposed earlier this year.

More than two decades ago, organizations learned hard lessons about exposing IT systems directly to the internet without adequate security controls. Firewalls, network segmentation, access gateways, and remote-access protections became standard practices for enterprise IT environments.  The fact that organizations still expose critical OT assets directly to the internet is not a sophisticated cybersecurity problem; it’s a foundational security problem. Or, put another way, this isn’t advanced threat defense, it’s Cybersecurity 101.

Attackers Are Scaling Faster Than Defenders

Threat actors no longer need deep expertise to discover exposed systems. Tools that identify internet-facing assets are readily available and easy to use. As attack surface management capabilities have become more accessible, automated, and comprehensive.  attackers benefit from these capabilities too because if they can find the device, they have their own tools that can probe and scan past the first exposure point to understand communication flows and other devices that are accessible. Now layer AI on top of that reality and while defenders are beginning to leverage AI to improve asset discovery, vulnerability prioritization, threat detection, and operational efficiency – that’s the good news – what’s less encouraging news is that attackers have access to many of the same advantages.

Security leaders should not view incidents like these in isolation. They are indicators of a broader trend. As discovery becomes easier and attack processes become more efficient, exposed operational systems will attract increasing attention not less.

Focus On Fundamentals Before The Next Incident

Security leaders don’t need to boil the ocean to improve their OT security posture.

Start with fundamentals:

    • Know what runs your business
    • Understand their vulnerabilities and risk
    • Reduce unnecessary exposure
    • Apply security controls consistently

Organizations often search for the next breakthrough technology that will improve security outcomes and usually the answer is far less exciting. Sometimes the answer is simply protecting the systems that keep your business running before someone else decides to turn them off.

The recent refrigeration attacks are not about doom-mongering but are a reminder: Attackers are moving faster, discovering more, and targeting systems that organizations continue to overlook.

The best time to address that problem was years ago. The second-best time is before the next attack. Don’t wait until your connected CNC machine is hacked and the attacker has it create the Jigsaw face.

Forrester clients interested in discussing this topic more should connect with us via an inquiry or guidance session.

Share