Commercial refrigeration, HVAC, and building management systems (BMS) are no longer isolated mechanical assets operating quietly in backrooms. Recent cyberattacks targeting refrigeration controllers across France, Sweden, Belgium, and at least eight other European nations have shown how exposed cyber-physical systems (CPS) lead to immediate physical and financial damage. In the incidents, grocery retailers bore the initial brunt of inventory loss due to manipulated refrigeration settings, including defrost controls. However, the underlying exposures may touch every enterprise reliant on critical climate control including pharmaceutical cold chains, hospital operating suites, data center chiller loops, and multi-site commercial properties.
Safeguarding these environments requires moving beyond reactive patch management to an actionable, low-friction exposure management strategy. Organizations must locate and identify exposed controllers, cut off direct internet access, and establish continuous operational visibility. This practical guide explains how multi-site operators can immediately discover unmanaged controllers, implement zero-trust access controls, and safeguard physical operations without operational downtime.
Why Auxiliary Controllers Are Targeted
Securing commercial cooling and environmental controls presents a unique operational challenge because these devices were built for accessibility and continuous uptime, not cyber resilience. Facility teams and third-party maintenance contractors frequently configure controller management interfaces with public IP addresses to facilitate off-site troubleshooting.
Attackers do not need complex zero-day exploit chains to manipulate these environments; they simply leverage legitimate administrative features on exposed equipment protected only by factory-default credentials.
The data highlights both the scale and the velocity of this risk:
Pervasive external exposure: Research by Claroty’s Team82 identified 2,765 internet-facing Danfoss AK-SM 800A and Copeland XWEB controllers globally prior to recent attacks. Note: While Team82 independently discovered and disclosed critical vulnerabilities in Danfoss and Copeland platforms, these specific CVEs have not been officially tied to the mentioned attacks. Rather, the incidents confirm that exposed management portals and default configurations provide threat actors with direct access to physical operations.
Weaponization of native functions: Threat actors forced cooling controllers into forced 50°C (122°F) defrost cycles, destroying massive stocks of temperature-sensitive inventory and causing immediate operations losses ranging from €50,000 to €270,000 in immediate losses per site.
AI-accelerated exploitation: Team 82 research demonstrated that an autonomous AI coding agent could reproduce disclosed firmware vulnerabilities and obtain root remote execution in under 30 minutes for six dollars in API costs.
When cooling controllers govern assets where thermal drift cannot be tolerated, closing these exposures cannot wait for slow, multi-month consulting engagements. Facility and security leaders need immediate, non-disruptive discovery starting with full visibility into auxiliary assets.
How to Rapidly Map Auxiliary CPS Exposures with Claroty Edge
The primary reason cooling controllers remain exposed is that security teams lack visibility into auxiliary facilities. In distributed, retail, healthcare, and manufacturing environments, cooling controllers, air handlers, and chiller loops are often deployed by external contractors and bypass centralized IT asset inventories. While removing internet exposure is essential, doing so is impossible if your organization does not know where these controllers are located or how they route traffic. You cannot defend or isolate devices that you cannot see.
Traditional operational technology (OT) monitoring tools struggle to address this blind spot because they require dedicated hardware sensors, complex network SPAN/TAP configurations, or restrictive program qualifications. Other market offerings are often strictly limited to small public utilities or focus primarily on centralized threat intelligence feeds.
Claroty solves this operational hurdle by making Claroty Edge freely accessible to organizations requiring rapid, non-invasive visibility. Operating as a free, non-persistent, and agentless diagnostic executable, Claroty Edge deploys in minutes to perform a rapid cybersecurity health check without requiring hardware installations or network changes.
Edge safely identifies OT, IoT, and BMS devices at the deepest layers of your network, highlighting unpatched vulnerabilities, EoL devices, outdated firmware, installed applications, and more. Rather than waiting for high-risk maintenance windows, your facility and security teams can run a health-check on demand to establish an immediate, comprehensive asset inventory and uncover your external exposure profile across dozens of sites simultaneously.
A 3-Step Guide to Executing a Rapid Health Check
Deploy without footprint: Download and run the Claroty Edge executable from an existing workstation or jump server connected to your facility or operational subnet. It leaves no persistent agent, software trace, or operational burden on network devices.
Safely map assets and subnets: Edge executes automated, safe queries tailored for industrial and commercial environments, querying deep into Layer 2 and Layer 3 segments. It catalogs all connected OT, IoT, BMS, and auxiliary controllers, including unmanaged Danfoss, Copeland, and Dixell units.
Generate actionable risk insights: Edge automatically correlates discovered devices against known vulnerability databases, end-of-life (EOL) records, and communication pathways. It then produces a comprehensive Cybersecurity Health Check Report detailing your asset inventory, missing patches, exploitable firmware versions, and active external exposure routes.
Eliminate Public Exposure with Zero-Trust Remote Access
Once internet-accessible controllers are identified, the immediate mandate is removing their management consoles from the public web. However, completely severing external connections is rarely realistic; mechanical contractors and facility engineers rely on remote connectivity to calibrate settings, service compressor loops, and respond to alarms. Disconnecting systems outright leads to maintenance blind spots or unmonitored shadow IT workarounds.
Standard corporate VPNs also fall short as granting a third-party maintenance technician open network access creates broad lateral movement paths if vendor credentials are breached. Instead, organizations should deploy compensating controls that bridge operational accessibility and zero-trust security.
By routing connections through a secure access gateway, facility teams can ensure no control interface is directly reachable via public IP addresses or queryable via public search engines. Rather than maintaining open network tunnels or exposed web portals, Claroty xDome Secure Access enforces identity-verified, just-in-time sessions protected by mandatory multi-factor authentication (MFA), so contractors are granted access strictly to designated controller ports, never the wider network. It also preserves contractor maintenance velocity while capturing an audit trail and full video session recording of every administrative action, ensuring any change to setpoints, defrost cycles, or operating thresholds is completely traceable.
Checklist: Securing Distributed Cooling Infrastructure
The recent European refrigeration compromises prove that threat actors actively seek the path of least resistance: auxiliary cyber-physical assets operating outside centralized IT and OT visibility. Safeguarding distributed environments from physical and environmental disruption is not a matter of waiting for complex maintenance cycles or deploying heavy, invasive hardware.
It requires executing a fast, decisive operational checklist:
Identify the blind spots: Immediately audit facility networks to inventory every auxiliary controller, thermostat, and air handler, closing the visibility gap between corporate security policies and third-party vendor installations
Eliminate default passwords: Immediately inventory and reset factory-default administrator credentials on every connected chiller, thermostat, and refrigeration hub.
Remove public exposure: Eliminate all direct internet pathways and rotate factory-default credentials across every connected device, ensuring controllers are never reachable via public search engines.
Control third-party access: Replace open web portals and broad VPNs with identity-based, least-privilege remote access to preserve contractor maintenance velocity while capturing full auditability of setpoint modifications.
The first step in securing mission-critical cooling environments is identifying where your internet exposure exists. Request your free Claroty Edge Health Check to identify unknown assets, identify critical exposures, and receive clear, actionable data in minutes. Plus, there’s zero hardware installation and zero operational downtime.
For more information on how to eliminate internet exposure and build an operational resilience program tailored to your environment, talk to a Claroty expert.
