New research from Forescout’s Vedere Labs identified 12,976 internet-exposed refrigeration service observations across 6,017 public IP addresses in 99 countries and territories, raising concerns about cybersecurity risks to hospitals and other facilities dependent on temperature-controlled storage.
Researchers warned that attackers could exploit weak authentication or software vulnerabilities to manipulate refrigeration temperatures, defrost cycles and alarms. In hospitals, similar attacks could threaten the storage of temperature-sensitive medications, vaccines and medical supplies, potentially resulting in product losses and disruptions to patient care.
The findings follow cyberattacks affecting more than 700 French supermarkets, where attackers reportedly manipulated refrigeration controls and caused food losses. Forescout also found that 80% of observed Danfoss StoreView services were running older firmware potentially affected by known vulnerabilities. The research identified exposed systems, not confirmed hospital compromises.
ㅤDamon Small, Board Member, Xcape Inc.:
“Unprotected refrigeration controllers represent an immediate threat to clinical operations and patient safety, where even slight temperature variations can spoil irreplaceable lab specimens, degrade critical pharmaceuticals, and interrupt acute care. The recent discovery by Forescout of nearly 13,000 Internet-exposed refrigeration services across 99 countries demonstrates that operational technology perimeters remain dangerously porous. These exposures are no longer merely theoretical. As documented in intelligence on groups like the Z-Pentest Alliance, politically motivated hacktivists increasingly target civil and commercial cooling infrastructure to intimidate populations and create societal strife, as seen in attacks across hundreds of French supermarkets. In a hospital setting, unauthorized manipulation of defrost cycles, temperature setpoints, or alarm thresholds can silently compromise life-saving inventories without triggering physical alarms in time. Security leaders must treat environmental controls as critical operational assets: audit external exposure, eliminate direct Internet connectivity, place management interfaces like Danfoss StoreView behind an authenticated virtual private network (VPN), and enforce strict network segmentation.
Critical Takeaways:
- Patient safety depends on cold-chain integrity: Tampering with refrigeration setpoints or alarm thresholds threatens vital medications, vaccines, and lab specimens, transforming physical facilities management into an acute clinical risk.
- Hacktivist motives focus on public disruption: Groups such as the Z-Pentest Alliance target operational technology to generate fear and civil strife, moving beyond basic website defacements to direct tampering with physical systems.
- Perimeter hygiene must isolate facility controls: Systems like Danfoss StoreView must never face the public Internet directly; defenders must isolate them on segmented subnets protected by multi-factor authenticated VPN connections.
“If an industrial chiller is easier to access from the Internet than your patient portal, your security architecture has melted.”
ㅤ
Seemant Sehgal, Founder & CEO, BreachLock:
“Nearly 13,000 refrigeration systems reachable from the public internet across 99 countries is the picture underneath incidents the industry has already seen this year.ㅤ
“The attack on Nichirei Logistics in Japan this summer disrupted deliveries to thousands of customers, and similarly, the attack on Danfoss refrigeration controllers in France earlier this month hit 700 supermarkets through manipulated temperature controls. Both ran on the same condition this research just quantified, and the pattern is still accelerating.
“For hospitals, cold chain integrity was built around physical reliability. The controllers running temperature-sensitive medication and vaccine storage were never designed assuming someone would be changing the setpoint on purpose. Any facility operating refrigeration this way should know which units are reachable from the internet, what their patch status actually is, and what happens if the primary temperature control stops responding on a weekend. A pentest of the refrigeration environment, specifically what an attacker could reach and change from the controllers themselves, is the right way to answer those questions before someone else answers them during an incident.”
Hospitals are low hanging fruit for threat actors. And it’s a symptom of a larger problem. One that needs fixing ASAP.
Related
This entry was posted on October 24, 2026 at 10:38 am and is filed under Commentary with tags Forescout. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Nearly 13,000 exposed refrigeration services raise cybersecurity concerns for hospitals
New research from Forescout’s Vedere Labs identified 12,976 internet-exposed refrigeration service observations across 6,017 public IP addresses in 99 countries and territories, raising concerns about cybersecurity risks to hospitals and other facilities dependent on temperature-controlled storage.
Researchers warned that attackers could exploit weak authentication or software vulnerabilities to manipulate refrigeration temperatures, defrost cycles and alarms. In hospitals, similar attacks could threaten the storage of temperature-sensitive medications, vaccines and medical supplies, potentially resulting in product losses and disruptions to patient care.
The findings follow cyberattacks affecting more than 700 French supermarkets, where attackers reportedly manipulated refrigeration controls and caused food losses. Forescout also found that 80% of observed Danfoss StoreView services were running older firmware potentially affected by known vulnerabilities. The research identified exposed systems, not confirmed hospital compromises.
ㅤDamon Small, Board Member, Xcape Inc.:
“Unprotected refrigeration controllers represent an immediate threat to clinical operations and patient safety, where even slight temperature variations can spoil irreplaceable lab specimens, degrade critical pharmaceuticals, and interrupt acute care. The recent discovery by Forescout of nearly 13,000 Internet-exposed refrigeration services across 99 countries demonstrates that operational technology perimeters remain dangerously porous. These exposures are no longer merely theoretical. As documented in intelligence on groups like the Z-Pentest Alliance, politically motivated hacktivists increasingly target civil and commercial cooling infrastructure to intimidate populations and create societal strife, as seen in attacks across hundreds of French supermarkets. In a hospital setting, unauthorized manipulation of defrost cycles, temperature setpoints, or alarm thresholds can silently compromise life-saving inventories without triggering physical alarms in time. Security leaders must treat environmental controls as critical operational assets: audit external exposure, eliminate direct Internet connectivity, place management interfaces like Danfoss StoreView behind an authenticated virtual private network (VPN), and enforce strict network segmentation.
Critical Takeaways:
“If an industrial chiller is easier to access from the Internet than your patient portal, your security architecture has melted.”
ㅤ
Seemant Sehgal, Founder & CEO, BreachLock:
“Nearly 13,000 refrigeration systems reachable from the public internet across 99 countries is the picture underneath incidents the industry has already seen this year.ㅤ
“The attack on Nichirei Logistics in Japan this summer disrupted deliveries to thousands of customers, and similarly, the attack on Danfoss refrigeration controllers in France earlier this month hit 700 supermarkets through manipulated temperature controls. Both ran on the same condition this research just quantified, and the pattern is still accelerating.
“For hospitals, cold chain integrity was built around physical reliability. The controllers running temperature-sensitive medication and vaccine storage were never designed assuming someone would be changing the setpoint on purpose. Any facility operating refrigeration this way should know which units are reachable from the internet, what their patch status actually is, and what happens if the primary temperature control stops responding on a weekend. A pentest of the refrigeration environment, specifically what an attacker could reach and change from the controllers themselves, is the right way to answer those questions before someone else answers them during an incident.”
Hospitals are low hanging fruit for threat actors. And it’s a symptom of a larger problem. One that needs fixing ASAP.
Share this:
Like this:
Related
This entry was posted on October 24, 2026 at 10:38 am and is filed under Commentary with tags Forescout. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.