How to Inventory the OT Controllers Your Facilities Contractors Put Online

When CERT-FR told French retailers on 12 October 2026 to pull their refrigeration controllers off the internet, the first obstacle for most of them was not technical. It was that IT did not know where the controllers were. A refrigeration contractor had installed them, connected them, and held the only list. This guide is the discovery and lockdown sequence for that situation, written for the IT or security team that has just inherited responsibility for devices it never procured.

It assumes you have no OT inventory to start from. If you already run a facilities asset register, skip to the external verification step and use the register as your hypothesis.

Step 1: Start from the physical world, not the network

OT devices in retail and commercial buildings are easiest to find by asking who services the building. Make a list of every maintenance contract for refrigeration, HVAC, lighting control, building management, fire and intrusion panels, fuel systems and loading-dock equipment. Each contractor is a potential source of remote access. Ask each one three questions in writing: which devices of theirs are installed at which sites, how they reach those devices remotely, and what credentials the devices use.

Expect vague answers. Contractors frequently subcontract installation, and the person who configured the modem five years ago may no longer work there. Treat the contractor's list as a starting point to verify, not a result.

Step 2: Walk the comms cabinet at a sample of sites

At a representative sample of locations, physically inspect the comms room and the plant room. You are looking for anything with an Ethernet port that IT did not install: supervisory controllers like the Danfoss AK-SM series or the Copeland and Dixell xweb units named in the CERT-FR alert, cellular routers with a contractor's label on them, small unmanaged switches hanging off the store router, and serial-to-Ethernet converters bolted to older panels. Photograph labels, note MAC addresses from the stickers, and record which switch port or modem each device connects to.

Cellular modems deserve special attention. A contractor-supplied modem with its own SIM gives a device a path to the internet that never touches your firewall, your logs or your monitoring. It is invisible from the network side by design.

Step 3: Look at your own edge from the inside

Back at the store router or firewall, review every inbound NAT rule, port-forward and firewall exception. Facilities devices tend to acquire these during an installation visit, justified by a work order nobody filed with security. Any rule that forwards a public port to an internal address you do not recognise is a candidate. Cross-reference the destination addresses with DHCP leases and ARP tables to identify the device, then match it to the physical walk.

Do the same for any site-to-site VPN or remote-access concentrator that terminates contractor connections. The question is which internal addresses a contractor's tunnel can reach, and whether that includes anything beyond the devices they maintain.

Step 4: Verify from the outside

Internal review finds what goes through your edge. It does not find the cellular modem. For that you need the attacker's view. Run your organisation's public IP ranges, and any ranges your telecoms provider has assigned to contractor SIMs if you can obtain them, through an internet scanning service and look for the web login pages of building and refrigeration controllers. Claroty's Team82 identified exposed Danfoss units in August 2026 by the distinctive HTTP signature of the StoreView management interface in Censys data; Shodan and Censys both carry fingerprints for common supervisory controllers. The existing guide How to Find Which of Your Admin Consoles Are Reachable From the Internet covers the general method for IT equipment; the only difference here is the fingerprints you search for.

If a device appears in external scanning and not in your internal review, it has a path you have not found. Go back to the physical walk.

Step 5: Decide the access model before you cut anything

Pulling a controller offline is the right instinct after an incident, and CERT-FR explicitly told operators to do it. But do it with a plan for restoring the contractor's access, or you will find the port-forward quietly back in place a week later. The access model that works is the one CISA recommended in its 2025 advisory on the Danfoss AK-SM 8xxA series: isolate the controller behind a firewall, remove direct internet reachability, and provide remote access through a VPN. In practice that means the contractor connects to a jump host or VPN concentrator you control, with their own named accounts, and from there reaches only the OT VLAN at the sites they service.

Put the controllers on a dedicated VLAN with no route to the corporate network and no outbound internet except what the vendor documents as required, usually time sync and alarm email. The controller does not need to reach the point-of-sale network, and the point-of-sale network does not need to reach the controller.

Step 6: Fix the device, then the monitoring

With the network path closed, handle the devices themselves in the order CERT-FR set out. For units you believe untouched: verify the complete configuration, especially defrost schedules and set points, against a known-good baseline; update firmware where the vendor still ships it, which for the Danfoss 8xxA series means R4.3.1 or later; enable the vendor's strict security mode; replace every default and shared credential. For anything that may have been compromised: factory reset, rebuild configuration, then harden. For end-of-life hardware such as the AK-SM800 or AK-SC355, there is no firmware to apply; isolate it completely and put it on a replacement schedule.

Then add the control that would have saved the French stores: temperature monitoring that does not depend on the controller. An independent probe in each cold room reporting to a separate system means a compromised controller cannot both cause the damage and hide it. How a Refrigeration Controller's Web Interface Becomes a Physical-Damage Attack Surface explains why that independence matters.

Step 7: Make the inventory stick

An inventory built in a crisis decays the moment the next contractor visit installs a new modem. Add two controls. First, a contractual one: every facilities contract gets a clause requiring written notice before any device is connected to a network or given remote access, with the security team as a named approver. Why 'Our Contractor Manages That' Is Not a Security Boundary for OT goes into what else belongs in that clause. Second, a technical one: schedule the external scan from Step 4 to run monthly against your ranges and alert on any new controller fingerprint. The devices will keep arriving; the goal is to see them before the attacker does.