Cyberside Chats: Cybersecurity Insights from the Experts

This weekend, attackers broke into the refrigeration controllers at hundreds of French supermarkets and turned the freezers into heaters. Alarms reached some store managers in time; in other stores nobody was paged, and many had to throw out all their fresh and frozen food. Researchers had published the flaws in these exact controllers two months earlier and found more than 2,700 of them sitting on the open internet. The manufacturer says most were end-of-life and no longer getting security updates.

It isn’t just supermarkets. Nation-states are hijacking security cameras to watch military movements, and a ransomware gang used a webcam to slip past EDR. Every IoT device in your environment is something someone else may want to control — to watch you, to disrupt your operations, or to get a foothold in your network.

Sherri Davidoff and Matt Durrin explain why so many of these devices fall through the cracks — installed by facilities teams and vendors, left unmonitored, and kept running long after support ends — and share five steps leaders can take to find them, own them and stay in control of them.

Key Takeaways:

1. Inventory the connected devices your facilities team and contractors installed, and give each one an owner. The supermarket controllers, the cameras and the Akira webcam share one property: everyone assumed someone else was looking after them. Every camera, controller and sensor needs a person accountable for patches, passwords and remote access, the same as a server.
2. Scan your own perimeter on a schedule. CISA advised in May 2025 that the Danfoss controllers be taken off the internet; 17 months later independent scans still found about 2,700 of them exposed. If you aren’t watching your perimeter, an exposed management interface is an open door into your network.
3. Decide at the contract stage what happens when the vendor stops supporting your equipment, and how long support is guaranteed. Hospitals and manufacturers know this pattern: multi-million-dollar hardware whose software quietly goes end-of-life. Understand the software’s lifespan before you buy, and hold the vendor to it in writing.
4. Make alerting survive the compromise of the thing it monitors. The refrigeration controllers’ alerts are configured on the same web interface the attackers controlled and travel over the same internet connection. Monitor critical temperatures with a separate device on a separate path, such as cellular, and make sure a real person is on the other end at 4 a.m.
5. Treat your vendors’ remote access as your attack surface, and bind them to your security policy. Don’t write a list of controls into the contract. Require vendors to adhere to your security practices, which can be updated as the threat landscape changes.

Resources:

1. Wall Street Journal, “Video Cameras Are Everywhere—and Now They Are Being Hacked for War” — https://www.wsj.com/tech/cybersecurity/video-cameras-webcams-hacked-war-b00b8a24
2. BleepingComputer, “Cyberattack shuts down refrigerators at French supermarkets” — https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/
3. Claroty Team82, “Freeze the Controller, Defrost the Food” — https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers
4. S-RM, “Camera off: Akira deploys ransomware via webcam” — https://www.s-rminform.com/latest-thinking/camera-off-akira-deploys-ransomware-via-webcam
5. LMG Security, 2026 Annual Penetration Testing Report