EU Supermarkets Lose Millions Due to Unpatched Refrigeration Firmware Managed by a Third‑Party Vendor

What happened

A third‑party OT service provider did not apply critical firmware updates to refrigeration units used by hundreds of European supermarkets. The outdated firmware caused cooling system failures, leading to spoilage of perishable goods and losses measured in millions of euros.

Why it matters for trust and compliance

• The event underscores a control‑objective gap in third‑party firmware oversight; continuous monitoring and documented vendor‑risk controls provide the audit evidence needed to demonstrate due diligence across frameworks.
• Establish continuous evidence collection on vendor patch management to satisfy audit requirements.
• Map vendor oversight to a single control objective that aligns with multiple frameworks (e.g., NIST CSF 2.0 governance and risk).

Who is affected

Recommended actions

1. Create an inventory of all OT devices and link each to its service contract.
2. Deploy automated tools to monitor firmware versions and flag out‑of‑date components.
3. Require vendors to provide documented patch‑management reports and retain them for audit readiness.