We at OT-Cyber.de rate the overall threat level for OT in Germany, Austria and Switzerland as high for KW 42/2026. Attackers manipulated internet-exposed refrigeration controllers in French supermarkets, and at the same time two edge devices that often guard the IT/OT boundary are under attack: Ivanti Connect Secure is actively exploited, and for Palo Alto PAN-OS the vendor reports very limited exploitation so far. If you run controllers with a public IP or rely on these gateways for remote access, take the controllers off the internet and treat the gateways as possibly compromised.
Key developments this week
Refrigeration controllers in French supermarkets manipulated. During the night of 11 to 12 October, attackers changed temperatures and defrost times in fridges and freezers in several hundred French supermarkets through remote controls that were reachable from the internet. Large amounts of food spoiled. CERTFR-2026-ALE-012 confirmed numerous compromised Danfoss AK-SM and AK-SC controllers on 12.10., added Copeland xweb and Dixell xweb on 13.10. and updated its recommendations on 16.10. CERT-FR considers the campaigns probably still ongoing and expects devices without patches (end of life) to be compromised again even after a factory reset. According to Reuters, at least 4,500 Danfoss interfaces were visible online on 13.10. Matching SANS ICS control: CC4 Secure Remote Access, plus CC5 for the end-of-life hardware.
BSI publishes BSI-CS 154. On 13 October the BSI released BSI-CS 154 "Gefährdung durch internet-verbundene OT-Systeme". It targets operators of small networked installations: food refrigeration, PV inverters, single wind turbines, drinking water and wastewater sites. The demand is blunt. Block direct internet access to controllers and secure remote access. The BSI explicitly warns of copycats. So far there is no confirmed case in DACH; the German retail association BVLH reports none in Germany. Matching control: CC2 Defensible Architecture.
Ivanti Connect Secure zero-day (CVE-2026-104935). The flaw is exploited in the wild and has been in the CISA KEV catalog since 13.10. The downstream privilege escalation in the chain still has no patch, and according to Volexity fully patched devices were affected too. Update to 22.8R2.5, 25.1.1.2 or 25.1.3.x, and do not rely on the Integrity Checker Tool alone. Matching control: CC4 Secure Remote Access, with CC1 for the incident response side.
Palo Alto PAN-OS root RCE via the management interface (CVE-2026-0322). Published 14.10., updated 15.10., CVSS 4.0 score 8.6, exploit maturity ATTACKED. Palo Alto describes very limited exploitation of the management interface; the flaw has been in KEV since 14.10. The advisory FAQ lists three IPs associated with the activity: 66[.]42[.]72[.]14, 208[.]83[.]239[.]114 and 149[.]248[.]47[.]234. Fixed versions include 12.2.4, 11.2.16 and 10.2.18-h12. Matching control: CC2 Defensible Architecture, with CC3 for the log review.
Eclipse Milo: six flaws in the OPC UA server (ICSA-26-288-01). The fix is only in version 1.1.5; the 0.6.x branch gets no patch. Milo is a library, so it hides inside SCADA products, gateways and control systems. Matching control: CC5 Risk-Based Vulnerability Management.
What it means per sector
Power & grids. No confirmed cyberattack on grid operators, municipal utilities or generators in DACH became known this week, so the sector sits at "elevated" rather than "high". The risk still comes in over the IT/OT boundary. At a typical Stadtwerk, an Ivanti VPN or a PAN-OS firewall is exactly what provides remote access into the control room and the segmentation between office and grid control systems. On the renewables side, a study by Modat and NCSC-NL counted 8,547 internet-reachable control and management systems in wind and solar parks, 884 of them in Germany, and at 181 sites in Europe the researchers had full control. If your Ivanti gateway was exposed, hunt in the logs back to 01.10. Full report (German)
Utilities (water, wastewater, municipal). BSI-CS 154 names drinking water and wastewater sites directly, next to refrigeration and PV. Think of the small pumping station or the elevated tank with a controller reachable through a port forward because that was the quickest way to give the integrator access. The same edge devices are in play here as in the power sector. Answer the BSI-CS 154 questions per site and move every external maintenance path behind a VPN with MFA. Full report (German)
Food & beverage. This was the sector most directly hit, at least in France. The attack worked because refrigeration contractors often get remote access the simple way: a public IP or port forward on the store controller, default password unchanged. In Germany and Switzerland the major retailers report no infection so far, and there are no officially confirmed cases in DACH. Production sites with cold storage use the same controllers. Set temperature alarms so they also fire when setpoints are deliberately changed, because an attacker who moves the setpoint can otherwise keep the alarm quiet. Check your insurance terms on data transfer to the contractor before you change the setup. Full report (German)
Machine builders. The French campaign is a lesson about the remote access you ship yourself. Find out which of your controllers and web interfaces are reachable from the internet at customer sites and write to those customers. Get rid of factory default passwords or force a change at commissioning, and inform customers about end-of-life products still in the field. Two more items land on your desk: Siemens SSA-591731 covers web server flaws up to CVSS 9.6 in SIMATIC S7-1500, ET 200SP and drive controllers, with no fix yet. Disable the web server where it is not needed, otherwise restrict 80/tcp and 443/tcp to fixed engineering IPs. And search your SBOMs and build dependencies for org.eclipse.milo, move to 1.1.5 and publish your own advisory. If your service technicians reach customers through an Ivanti gateway, rotate the AD credentials that went through it and review those service paths. Full report (German)
What to do now
- Disconnect every refrigeration and building controller with a public IP (Danfoss, Copeland, Dixell and the rest). Contractor access only via VPN with MFA; a firewall rule limited to the contractor's IPs is a stopgap at best. Change default passwords, compare setpoints, configuration and defrost schedules with the target values, set Danfoss devices to the "Strict" security mode and plan replacement of end-of-life units.
- Patch Ivanti Connect Secure and treat the gateway as compromised: network and memory forensics, Volexity IoCs, log review. Reset accounts and service accounts used over the VPN. Until the privilege escalation is fixed, put a separate jump host with its own login and MFA between the VPN and the OT network.
- Patch PAN-OS and make the management interface reachable only from a dedicated admin network or through a jump host. Enforce MFA for admin accounts, review admin logins and configuration changes of the last weeks, and search logs for 66[.]42[.]72[.]14, 208[.]83[.]239[.]114 and 149[.]248[.]47[.]234.
- Ask your SCADA, gateway and control system vendors whether Eclipse Milo is in their SBOM and request their patch plan. Meanwhile disable anonymous OPC UA sessions and keep OPC UA servers reachable only from the OT zone.
- Work through the BSI-CS 154 questions for every networked installation (internet exposure, VPN, second factor, update status) and put the answers into your asset inventory.
Full sector reports (German)
- All sectors (DACH overview)
- Power & grids
- Utilities (water, wastewater, municipal)
- Food & beverage production
- Machine builders (CRA)
- All sectors at a glance
Max Gilg is an OT cybersecurity consultant based in Rosenheim, Germany (OT-Cyber.de).
Top comments (0)