Overnight on November 2, attackers logged into the refrigeration controllers at supermarkets in at least seven European countries and told the freezers to defrost. Some units were pushed to 50°C (122°F). By morning, stores in Belgium, Sweden, Ireland, Estonia and elsewhere were throwing out spoiled food. Three days later, five U.S. federal agencies warned American operators to watch for the same thing here. If you run a water or sanitation district in Colorado, this is not really a grocery story. It is a preview of your own risk, and the fix starts with questions you can ask this week.
What actually happened
This was the second wave. On October 11, attackers took control of refrigeration controllers at up to 700 supermarkets across France and switched them into defrost mode overnight. Losses were estimated in the tens of millions of euros.
Three weeks later it happened again, this time across several countries at once. The Delhaize chain reported an "IT incident" affecting several dozen stores in Belgium and Luxembourg. Carrefour reported 15 affected stores in Belgium. In Ireland, SuperValu pulled chilled and frozen products from 13 stores. A Swedish ICA store posted that its fridges and freezers had been set to 50°C.
The affected equipment was mostly Danfoss AK-SM and AK-SC refrigeration controllers, and the French national cybersecurity agency later added Copeland and Dixell XWEB monitoring platforms to the list. French authorities have since attributed the October attack to cyber units inside Iran's Islamic Revolutionary Guard Corps.
On November 5, CISA, the FBI, HHS, USDA and the Department of Transportation released a joint fact sheet telling U.S. operators to take refrigeration controllers off the public internet, eliminate default passwords, apply available patches, and retire controllers the vendor no longer supports.
How they got in
Officially, the exact entry point is still unconfirmed. But nothing reported so far suggests anything exotic.
These controllers each run a small web server for remote management, and many of them were reachable directly from the internet. A Danfoss spokesperson told Dutch broadcaster NOS that the systems hit in the second wave were not on secure networks and were protected by a default password. France's cybersecurity agency pointed to the same two problems: equipment reachable from the internet without special protection, and weak passwords. It specifically said the publicly disclosed vulnerabilities were not what the attackers used.
Two other details are worth noticing. First, before the October attack, internet scans counted roughly 3,000 exposed controllers. By November 5 that number had dropped to about 700. In other words, thousands of operators fixed the problem within weeks, which means thousands of operators did not know it existed until it was on the news. Second, many of the French stores had outsourced refrigeration to a service contractor and were not managing the security of those systems themselves.
Exposed management interface. Default credentials. A third party holding the keys. Nobody inside watching.
Why this is a water district story
If that list sounds familiar, it should. It describes a lot of small utility operational technology (OT) environments.
In November 2023, an IRGC-affiliated group calling itself CyberAv3ngers took over a Unitronics PLC at a booster station run by the Municipal Water Authority of Aliquippa, Pennsylvania. The controller was reachable from the internet and still had its default password. The same group hit similar devices at other U.S. water utilities. The pattern is the same one we just watched play out in European grocery stores: the same state sponsor, internet-facing OT, and passwords nobody changed.
Colorado special districts carry many of the same risk factors. Staff are small and stretched. SCADA systems are often designed, installed and supported by an integrator who needs remote access after hours. Business IT may be handled by yet another provider. And the equipment that runs the plant was frequently installed for reliability, years before anyone thought about who else on the internet could see it.
The difference is consequence. A hacked freezer spoils inventory. A hacked HMI or PLC at a water or wastewater plant can affect pumps, tank levels, pressure and chemical feed. The federal advisory also calls out loss of visibility into current conditions, where operators can no longer trust what the screen is telling them. In a water system, that is a public health problem, not a write-off.
It is also worth remembering that the European targets were not SCADA systems in the traditional sense. They were "building" equipment that someone connected for convenience. Your district likely has the same category of device: HVAC and building controls, generator and transfer switch controllers, UPS management cards, camera systems, and chemical storage monitoring. Those are often the least watched devices on the network.
What to check this week
Find out what is visible from the internet. Ask your IT provider or integrator for a list of every public IP address the district uses, then find out what answers on each one. If a login page for an HMI, PLC, building controller or camera system comes up, that is your first priority.
Ask your integrator exactly how they get in. You want a specific answer: through what path, from where, with whose credentials, and with or without multi-factor authentication. Shared vendor accounts and always-on remote access tools are common and risky. "We just log in" is not an answer.
Eliminate default and shared passwords. Every HMI, PLC, engineering workstation, controller and management interface should have unique credentials. Default passwords for most industrial and building equipment are published in the vendor's own manuals, and attackers use them first.
Separate OT from the business network. A compromised office PC or phished email account should not be one hop away from the plant. If your SCADA and business systems sit on one flat network, that is worth fixing even if nothing is exposed to the internet today.
Inventory the devices that are not "SCADA." Walk the building with someone who knows it and list every connected device that controls or monitors something physical. The European attackers went after the refrigerator, not the cash register.
Confirm your manual fallback. If the screens cannot be trusted, can your operators run the plant by hand, and have they practiced it recently? Resilience matters as much as prevention.
Where an outside test fits
Most of these checks can start with a phone call to your integrator. Verifying the answers is harder. An external assessment shows you what an attacker sees from the internet. An internal network penetration test shows whether a compromise on the business side can reach the systems that run the plant, and whether segmentation actually works the way the network diagram says it does.
Mile High Cyber has tested networks for Colorado water and sanitation districts and other special districts, and our OT testing is coordinated with your operators and done with someone who designs and builds SCADA systems for a living. We do not run active attacks against live process controllers without your explicit approval.
If you are not sure where to start, our free External Cyber Exposure Review is a non-invasive outside-in snapshot of one domain: what is exposed, what services are answering, and whether any of your credentials show up on the dark web.
If you want to know what your district looks like from the internet, or want your OT exposure tested rather than assumed, talk to a founder directly. No sales process, no obligation.
Terry Bradley, CISSP, is the President and Founder of Mile High Cyber, with nearly 30 years of experience in cybersecurity. A CISSP since 2008, he specializes in penetration testing, vulnerability management, and virtual CISO services, helping small and mid-sized organizations identify, remediate, and verify their most critical security risks.