On Monday, Nov 2nd, grocery chains across Europe experienced temperature spikes that destroyed tens of millions of dollars worth of perishable food across thousands of locations. This happened less than three weeks after similar attacks in France when refrigeration units across hundreds of supermarkets — Intermarché, Carrefour, E. Leclerc, and others — were remotely driven into “defrost” mode overnight. Temperatures climbed past 100°F. Freezers turned into ovens, destroying all the perishable food within. Threat actors targeted internet-connected refrigeration controllers, forcing systems into a continuous, 50°C (122°F) defrost cycle. Because a defrost is a legitimate operational state, the controllers suppressed standard automated alarms, keeping store personnel in the dark until morning. The result was massive food waste and supply chain chaos.A similar pattern repeated at U.S. military commissaries — Fort Huachuca, Fort Irwin, Naval Station Newport, and others — where freezers were similarly reprogrammed overnight. The Pentagon is now treating the episodes as coordinated cyberattacks, with U.S. Cyber Command and Army investigators working alongside European authorities to trace a common actor.Whether the target is a supermarket, a manufacturing plant, a warehouse, or a military installation, the lesson is clear: when cyberattacks reach operational technology (OT), the consequences become physical—spoiled inventory, food shortages, safety risks, and loss of public trust. The “Patch” Reality in OT SystemsThe primary driver behind these attacks is a critical vulnerability (CVE-2025-41450) uncovered by Claroty’s Team82 in their report. This authentication bypass in widely used Danfoss AK-SM 800A controllers allowed anyone reverse-engineering a simple date-based algorithm to bypass login screens. Compounding the issue, scanning platforms revealed thousands of these controllers exposed directly to the public internet. But as we highlighted in our earlier blog post —”The Fix Has Been Out for a Year. The Controller Is Still Exposed”—these devices remain largely unpatched and still exposed.Traditional IT security best practices recommend patching all systems regularly, but OT operators face unique hurdles:Downtime Risks: Taking operational systems offline risks production downtime, supply interruptions and product wastage.End-of-Life Assets: Many active controllers are legacy models that are no longer supported or patched.Resource Constraints: Many OT controllers may not have sufficient memory or CPU resources to accept the patch. Hardware upgrades are expensive.All of these ensure the ongoing availability of an enormous unpatched OT attack surface. It doesn’t take an attacker —or an AI agent— long to figure out a damaging exploit and cause chaos. Refrigeration systems today, water plants tomorrow, power grids the day after? Why This Keeps HappeningRefrigeration controllers, like most OT and industrial IoT devices, were never designed with the modern threat landscape in mind. They’re deployed for decades, maintained by third-party technicians who need remote access, and frequently connected directly to the internet because segmenting them properly takes effort most operators don’t have time for. Add flat, “trust-everything” networks, and one exposed controller becomes a bridge into an entire facility—or, as we’re now seeing, a repeatable playbook an actor can run against hundreds of sites in parallel.Firewalls and VPNs don’t solve this. They were built to protect perimeters, not to stop an attacker from walking laterally once it’s inside. Adding another appliance or service doesn’t fix this when lateral movement is the feature, not the flaw. OT environments need an architecture that assumes compromise is possible and limits what any single device—or attacker—can reach. Zero trust changes the operating modelZero trust isn’t just a feature on a firewall. It’s a fundamentally different architectural approach. If your starting point is a flat network with implicit trust, you cannot get to zero trust by simply inserting firewalls everywhere. It’s like building a superhighway and adding toll gates every few miles—it’s expensive, complex and slows everyone down.Zero trust starts by not extending the same network everywhere. All communication is brokered through an exchange based on identity and context, with continuously-monitored adaptive access. No route extension. This eliminates unrestricted lateral movement between sites. For OT that means replacing broad network access with granular segmentation — both between and within sites. All communication in & out should be restricted to what the OT systems need, and no more. A controller should communicate only with approved services—not with any device that happens to share a subnet.Another key principle of a zero trust architecture is eliminating the attack surface. All connections are inside-out — from the factory or supermarket out to the Internet — not the other way around. No exposed VPN ports. No attack surface for hackers to exploit.For OT, that means eliminating all exposure to the Internet or third-party networks. A refrigeration technician should be able to reach the authorized controller for a defined maintenance action—not gain routable access to the store, site, or plant network. Zscaler Zero Trust for IoT/OTZscaler protects OT environments in three ways.1. Eliminates the attack surfaceTraditional SD-WAN or VPN-based connectivity extends the corporate network to every location. Firewalls and VPNs —often required for third-party vendor access—leave open exposed ports that become a route inwards. That model makes every device, factory or supermarket an attractive target because compromise at one site becomes an open door into the entire organization.Zscaler’s Zero Trust architecture hides everything. It enables users, agents and IoT/OT systems to securely communicate with apps through the Zero Trust Exchange, without exposing controllers and firewalls to the Internet. Zscaler’s Zero Trust Branch securely connects fixed sites such as supermarkets or warehouses, while Zscaler Cellular connects field assets and mobile IoT/OT (ex. fleet vehicles, remote sensors, scanners etc.). Zscaler Privileged Remote Access also enables third parties to securely connect to IoT/OT systems through a browser without ever being on the OT network.2. Eliminates lateral threat movementUnpatched OT systems will continue to remain a reality for the foreseeable future. What if you could isolate each controller, PLC or HMI into a “network-of-one” and limit the blast radius in the event of a compromise?Zscaler Zero Trust Device Segmentation, a key capability within Zero Trust Branch, does just that. Every device is isolated into a /32 micronetwork segment — without the need for agents or certificates on the OT system, removing a huge barrier for granular microsegmentation within OT environments. Each supermarket and controller becomes an island. All communication within the site is restricted — even within the same VLAN. This limits the ability of attackers to reach controllers by moving laterally, and in the event they do gain access to one, it ensures they cannot compromise the entire supermarket or warehouse.3. Ensures effective visibility & controlPlant operators often lack a full inventory and understanding of their OT systems. Traditional approaches from the IT world, like scanners and agents, do not work on OT systems. Many OT devices are far too brittle or outdated. As a result, plants and supermarkets remain vulnerable. Field and mobile OT assets compound this problem.Zscaler’s Zero Trust Branch enables agentless discovery & classification for headless devices, including IoT and OT assets. This helps security teams identify their OT estate, and take appropriate steps to secure it. Full visibility into east-west as well as north-south communication ensures an accurate understanding of communication patterns and cyber exposure. Zscaler Cellular extends this visibility by adding location and usage information enabling effective governance of the entire IoT/OT footprint. Design for containment, not just preventionPatching known vulnerabilities remains essential. But the ground reality in OT environments mandates a different architectural approach.The refrigeration incidents underscore a more durable principle: OT resilience depends on containing inevitable failures and compromises. Zero trust provides that containment by making each connection explicit, each device constrained, and each site less capable of becoming a launch point for a broader attack.Learn more about Zscaler IoT/OT solutions here and contact us for a demo.
[#item_full_content] On Monday, Nov 2nd, grocery chains across Europe experienced temperature spikes that destroyed tens of millions of dollars worth of perishable food across thousands of locations. This happened less than three weeks after similar attacks in France when refrigeration units across hundreds of supermarkets — Intermarché, Carrefour, E. Leclerc, and others — were remotely driven into “defrost” mode overnight. Temperatures climbed past 100°F. Freezers turned into ovens, destroying all the perishable food within. Threat actors targeted internet-connected refrigeration controllers, forcing systems into a continuous, 50°C (122°F) defrost cycle. Because a defrost is a legitimate operational state, the controllers suppressed standard automated alarms, keeping store personnel in the dark until morning. The result was massive food waste and supply chain chaos.A similar pattern repeated at U.S. military commissaries — Fort Huachuca, Fort Irwin, Naval Station Newport, and others — where freezers were similarly reprogrammed overnight. The Pentagon is now treating the episodes as coordinated cyberattacks, with U.S. Cyber Command and Army investigators working alongside European authorities to trace a common actor.Whether the target is a supermarket, a manufacturing plant, a warehouse, or a military installation, the lesson is clear: when cyberattacks reach operational technology (OT), the consequences become physical—spoiled inventory, food shortages, safety risks, and loss of public trust. The “Patch” Reality in OT SystemsThe primary driver behind these attacks is a critical vulnerability (CVE-2025-41450) uncovered by Claroty’s Team82 in their report. This authentication bypass in widely used Danfoss AK-SM 800A controllers allowed anyone reverse-engineering a simple date-based algorithm to bypass login screens. Compounding the issue, scanning platforms revealed thousands of these controllers exposed directly to the public internet. But as we highlighted in our earlier blog post —”The Fix Has Been Out for a Year. The Controller Is Still Exposed”—these devices remain largely unpatched and still exposed.Traditional IT security best practices recommend patching all systems regularly, but OT operators face unique hurdles:Downtime Risks: Taking operational systems offline risks production downtime, supply interruptions and product wastage.End-of-Life Assets: Many active controllers are legacy models that are no longer supported or patched.Resource Constraints: Many OT controllers may not have sufficient memory or CPU resources to accept the patch. Hardware upgrades are expensive.All of these ensure the ongoing availability of an enormous unpatched OT attack surface. It doesn’t take an attacker —or an AI agent— long to figure out a damaging exploit and cause chaos. Refrigeration systems today, water plants tomorrow, power grids the day after? Why This Keeps HappeningRefrigeration controllers, like most OT and industrial IoT devices, were never designed with the modern threat landscape in mind. They’re deployed for decades, maintained by third-party technicians who need remote access, and frequently connected directly to the internet because segmenting them properly takes effort most operators don’t have time for. Add flat, “trust-everything” networks, and one exposed controller becomes a bridge into an entire facility—or, as we’re now seeing, a repeatable playbook an actor can run against hundreds of sites in parallel.Firewalls and VPNs don’t solve this. They were built to protect perimeters, not to stop an attacker from walking laterally once it’s inside. Adding another appliance or service doesn’t fix this when lateral movement is the feature, not the flaw. OT environments need an architecture that assumes compromise is possible and limits what any single device—or attacker—can reach. Zero trust changes the operating modelZero trust isn’t just a feature on a firewall. It’s a fundamentally different architectural approach. If your starting point is a flat network with implicit trust, you cannot get to zero trust by simply inserting firewalls everywhere. It’s like building a superhighway and adding toll gates every few miles—it’s expensive, complex and slows everyone down.Zero trust starts by not extending the same network everywhere. All communication is brokered through an exchange based on identity and context, with continuously-monitored adaptive access. No route extension. This eliminates unrestricted lateral movement between sites. For OT that means replacing broad network access with granular segmentation — both between and within sites. All communication in & out should be restricted to what the OT systems need, and no more. A controller should communicate only with approved services—not with any device that happens to share a subnet.Another key principle of a zero trust architecture is eliminating the attack surface. All connections are inside-out — from the factory or supermarket out to the Internet — not the other way around. No exposed VPN ports. No attack surface for hackers to exploit.For OT, that means eliminating all exposure to the Internet or third-party networks. A refrigeration technician should be able to reach the authorized controller for a defined maintenance action—not gain routable access to the store, site, or plant network. Zscaler Zero Trust for IoT/OTZscaler protects OT environments in three ways.1. Eliminates the attack surfaceTraditional SD-WAN or VPN-based connectivity extends the corporate network to every location. Firewalls and VPNs —often required for third-party vendor access—leave open exposed ports that become a route inwards. That model makes every device, factory or supermarket an attractive target because compromise at one site becomes an open door into the entire organization.Zscaler’s Zero Trust architecture hides everything. It enables users, agents and IoT/OT systems to securely communicate with apps through the Zero Trust Exchange, without exposing controllers and firewalls to the Internet. Zscaler’s Zero Trust Branch securely connects fixed sites such as supermarkets or warehouses, while Zscaler Cellular connects field assets and mobile IoT/OT (ex. fleet vehicles, remote sensors, scanners etc.). Zscaler Privileged Remote Access also enables third parties to securely connect to IoT/OT systems through a browser without ever being on the OT network.2. Eliminates lateral threat movementUnpatched OT systems will continue to remain a reality for the foreseeable future. What if you could isolate each controller, PLC or HMI into a “network-of-one” and limit the blast radius in the event of a compromise?Zscaler Zero Trust Device Segmentation, a key capability within Zero Trust Branch, does just that. Every device is isolated into a /32 micronetwork segment — without the need for agents or certificates on the OT system, removing a huge barrier for granular microsegmentation within OT environments. Each supermarket and controller becomes an island. All communication within the site is restricted — even within the same VLAN. This limits the ability of attackers to reach controllers by moving laterally, and in the event they do gain access to one, it ensures they cannot compromise the entire supermarket or warehouse.3. Ensures effective visibility & controlPlant operators often lack a full inventory and understanding of their OT systems. Traditional approaches from the IT world, like scanners and agents, do not work on OT systems. Many OT devices are far too brittle or outdated. As a result, plants and supermarkets remain vulnerable. Field and mobile OT assets compound this problem.Zscaler’s Zero Trust Branch enables agentless discovery & classification for headless devices, including IoT and OT assets. This helps security teams identify their OT estate, and take appropriate steps to secure it. Full visibility into east-west as well as north-south communication ensures an accurate understanding of communication patterns and cyber exposure. Zscaler Cellular extends this visibility by adding location and usage information enabling effective governance of the entire IoT/OT footprint. Design for containment, not just preventionPatching known vulnerabilities remains essential. But the ground reality in OT environments mandates a different architectural approach.The refrigeration incidents underscore a more durable principle: OT resilience depends on containing inevitable failures and compromises. Zero trust provides that containment by making each connection explicit, each device constrained, and each site less capable of becoming a launch point for a broader attack.Learn more about Zscaler IoT/OT solutions here and contact us for a demo.
