Off the map: why your most critical systems should be invisible

What happened in France

Overnight from 11 to 12 October 2026, attackers took remote control of refrigeration management systems in French supermarkets and forced them into defrost cycles, pushing temperatures as high as 50°C. Stock was destroyed and several stores reported fires. France's finance minister told parliament that about 700 of the country's 10,000 supermarkets were affected (ITV).

The controllers came from Danfoss. The vendor said most of the affected systems were older products that no longer received software or security updates. France's national cybersecurity agency, ANSSI, told operators to take the affected controller series off the network immediately (Forklog). Two months earlier, Claroty's Team82 had published research on weaknesses in these controllers, and a Censys scan had counted 2,765 of their management interfaces reachable online (Security Affairs).

Known weakness, published research, thousands of reachable interfaces, no patch path for legacy units.

The attack was not a surprise. It was a timetable.

Not an isolated case

The same pattern ran through the whole of 2026.

1. April 2026 · United StatesA joint advisory from the FBI, CISA, NSA, EPA, DOE and US Cyber Command confirmed a campaign disrupting internet-connected PLCs across US critical infrastructure (RISI database).
2. 26–27 July 2026 · MinnesotaMore than 30 water and wastewater facilities were hit at the same time. Some communities asked residents to cut water use; others switched to manual operations (National Law Review).
3. 30 July 2026 · CISA alertCISA warned that attackers were logging into exposed PLCs, changing passwords to lock operators out and changing IP addresses to cut devices off, leading to boil-water notices and long stretches of manual operation. Cellular modems installed by operators, vendors or integrators often never show up in routine scans (Censys, citing CISA and FBI/EPA).
4. 11–12 October 2026 · FranceAbout 700 supermarkets lose control of their refrigeration in a single night.

Different sectors, same root cause: a control system that answered when someone on the internet knocked.

The exposure problem in numbers

Censys observed about 134,000 distinct hosts running industrial control services exposed on the internet in early 2026, up roughly 4% from 2024. Around 70% of them sit on consumer and mobile networks. That creates what Censys calls an exposure notification gap: a researcher who finds an exposed controller on a mobile carrier's address space can often only warn the carrier, which has no authority over the device. The operator may never hear about it (Censys).

Bitsight, using a different method, counts 170,000 to 180,000 exposed industrial devices a month across 15 protocols (Viakoo summary of Bitsight). The counts differ; the direction does not.

The devices most often exposed this way live in substations, pump houses, remote well sites and unstaffed plants, where cellular is the only practical link. That describes a large share of the oil, gas, water and power assets in our region.

Why patching alone cannot win this race

The 2026 Verizon Data Breach Investigations Report found that exploiting vulnerabilities has become the most common way breaches start, for the first time in the report's history: 31% of initial access, up from 20% a year earlier (watchTowr analysis of the DBIR). Remediation is moving the other way. Median patch time rose from 32 to 43 days (Tenable), while critical flaws in edge devices are mass-exploited within hours or days of disclosure.

AI is compressing the attacker's side even further. That is the subject of our next article.

When attackers move faster than your maintenance window, and part of your fleet cannot be patched at all, the one variable you fully control is whether they can reach the system in the first place.

From hardened to invisible

Most security architecture assumes the asset is visible and tries to make it hard to break. The alternative is to make it unreachable: no public IP address, no listening port, nothing for a scanner to fingerprint. A system that does not answer cannot be enumerated, cannot be indexed by internet search engines for devices, and cannot be hit on the night an exploit is published.

This is where regulators are heading too. On 28 July, CISA and Australia's cyber agency published guidance telling critical infrastructure operators to be ready to isolate vital systems during attacks or periods of heightened threat (National Law Review). And exposure can be reduced when it becomes a priority: Europe's share of exposed industrial hosts fell from 36.5% in 2024 to 32% in early 2026, with France, Italy and Belgium driving most of the drop (Censys).

France is the lesson in both directions. It cut its overall exposure, and still lost hundreds of stores to the devices that were left behind. The long tail of forgotten equipment is what bites.

Five moves for operators

1. 01Map everything reachable, including the modem nobody documented. Assume your asset inventory is incomplete and scan yourself from the outside, the way an attacker would.
2. 02Remove inbound reachability from control systems. No public IPs, no open management ports, no port forwarding left "temporarily" for a vendor.
3. 03Rebuild remote access. Replace exposed interfaces with brokered, outbound-only connections tied to identity, logged and time-limited. Vendor maintenance access is exactly the channel that made the refrigeration controllers reachable.
4. 04Design to run isolated. If you had to disconnect tonight, which processes keep running, and for how long? Test it before a crisis forces the answer.
5. 05Put legacy equipment on a clock. Anything that no longer receives security updates should be isolated now and replaced on a schedule, not after it fails in public.