Nextgov/FCW reports that U.S. officials suspect Iran-linked hackers caused freezers to malfunction at about six military commissaries beginning in late August, and that U.S. Cyber Command and Defense Department law enforcement units are investigating. At Fort Huachuca in Arizona, a freezer entered defrost mode and heated its contents until the food spoiled. Officials have not confirmed the cause or the attacker, and the attribution may change as the investigation continues.
What is not in doubt is the pattern unfolding around those incidents. Over the past two months, attackers have taken control of commercial refrigeration across Europe, and the way they did it points to a weakness that runs through nearly every operational technology environment: the devices accept commands without verifying who sent them.
What happened in Europe?
In October, attackers forced refrigeration systems at roughly 700 French supermarkets into a continuous defrost cycle and pushed some temperatures as high as 50°C (122°F), according to the Associated Press, citing France's finance minister, who called the attack a wake-up call that touches the heart of the country's food security. Security researchers at Claroty had reported in August that numerous refrigeration controllers were directly reachable from the public internet.
About 700 of France's roughly 10,000 supermarkets lost control of their refrigeration in a single attack wave.
On November 3, The Record reported a second wave that reached grocers and suppliers in the UK and Belgium. The British victims were attacked through Copeland XWEB supervisory controllers, and a security note circulated among affected businesses said firmware version 1.12.1 and earlier contained authentication-bypass vulnerabilities that allowed control without a password. One wholesaler avoided losses only because staff physically disconnected a refrigeration unit.
Why is this an authentication problem and not just a patching problem?
A firmware fix for the XWEB vulnerabilities had been available since August, so it is tempting to file these incidents under poor patch hygiene. That diagnosis is incomplete. A patch closes one product's defect, but it leaves in place the condition that made the attacks easy in the first place, which is that a controller acts on any command from anything that can reach it on the network.
Patching also assumes there is something to patch. Vendors told reporters that many of the affected French systems were older or end-of-life products that no longer receive security updates. Those controllers will keep running in stores, warehouses and installations for years, and no firmware update is coming for them.
Refrigeration is not unusual in this respect. Building automation, HVAC, water treatment and utility controls were designed for closed networks where being able to reach a device was treated as proof of authority. Once those devices become reachable from a corporate network, a vendor's remote-access path or the internet, any attacker with network access inherits the authority of the operator.
Why didn't PKI solve device authentication years ago?
Certificate-based authentication was never a realistic option for most of these devices. Small controllers lack the processing headroom for certificate validation, many sites cannot reliably reach a certificate authority, and no grocery chain or base commissary is staffed to manage certificate lifecycles across thousands of refrigeration units. The industry therefore skipped device authentication altogether, and that gap is exactly what these attacks exploited.
What does closing the gap look like?
Operators do not need to replace working refrigeration or building systems to fix this. They need the traffic that controls those systems to meet three conditions:
- Every command is authenticated. A controller should act only on traffic it can cryptographically verify came from an authorized peer, so that network reachability no longer implies control.
- Every session is encrypted and independently verified. Static passwords and long-lived credentials can be harvested, reused or bypassed by a firmware flaw. Session-based keys that change with every session leave nothing to steal.
- Protection reaches legacy equipment. Devices that will never receive another firmware update can be protected inline at the network edge, so the fix does not depend on the vendor.
Where AKM fits
Autonomous Key Management™ delivers authentication and encryption to OT endpoints that PKI could never reach. AKM runs as a sub-1MB embedded executable on new devices or as an inline module in front of legacy controllers, verifies every session independently with no certificate authority dependency, and changes keys autonomously with every session. The result is Zero Trust at the protocol layer of the devices themselves, including in air-gapped environments.
What should OT operators take from this?
The freezer attacks deserve attention well beyond the food sector, because the same design assumption runs through water systems, power distribution and military installations. For every controller in the environment, operators should ask whether the device can distinguish a legitimate command from a forged one. Where the answer is no, the network boundary is the only control in place, and the past two months have shown how quickly that boundary fails.
About AKMSecure
AKMSecure delivers a patented Autonomous Key Management™ protocol built to replace outdated PKI approaches with a dynamic, quantum-secure, air-gapped-capable architecture. Instead of relying on persistent credentials that can be stolen, reused, or abused, AKM enables independently verified sessions with no standing privileges left behind. The result is a model that better aligns with Zero Trust principles, reduces certificate-based risk, and supports resilient operations across enterprise IT, OT and Tactical Edge environments. Built to NSA-grade security standards and deployable as a lightweight SDK, AKMSecure helps organizations modernize trust at the protocol layer without rebuilding everything around it.
